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U.S. Department of Justice 


Federal Bureau of Investigation 


i Reply, Please Refer to 505 South Main, Suite 115 

lie No. , /j f 

7A-AN-15642 ) Las Cruces, New Mexico 88001 

April 10, 2012 


Mesiila Valley Regional Dispatch Center 
130 West Lohman 
Las Cruces, New Mexico 88001 

RE: Abduction of Samantha Koenig 

Dear | | 

This letter is to thank the Mesiila Valley Regional Dispatch 
Center (MVRDC) personnel, especially those personnel who called 
back to advise whether or not suspect vehicle photographs had 
been received and coordinated getting those photographs to patrol 
units, for their help during the early morning hours of March 8, 
2012. The Las Cruces FBI office called MVRDC at approximately 4 
a.m. to request patrol units watch ATMs near Interstate 10 and 
Interstate 10 itself for the possible suspect vehicle. Due to 
the very fluid nature of the situation and the very vague 
description of the suspect vehicle, a white sedan, their 
continued assistance and attention to this matter is greatly 
appreciated. Once ATM surveillance photographs of the suspect 
vehicle later were obtained that morning, the MVRDC ensured those 
photographs were received at the MVRDC and distributed to area 
agencies to helped locate and identify the suspect vehicle. 

These actions helped eliminate several potential matches and 
contributed to the Be On the Look Out (BOLO) that led to the 
suspect's apprehension in Humble, Texas, several days later. 

The Las Cruces Office of the Federal Bureau of Investigation 
greatly appreciates the MVRDC's commitment and service in this 
matter. 



Sincerely, 


Supervisory Special Agent 


ANltrOl.wpd 


r 










U.S. Department of Justice 


Federal Bureau of Investigation 


In Reply, Please Refer to 
File No, 

7A-AN-15642 




505 South Main, Suite 115 
Las Cruces, New Mexico 88001 
April 10, 2012 


Captain | | 

New Mexico State Police 
3000 East University 
Las Cruces, New Mexico 88001 

RE: Abduction of Samantha Koenig 

Dear Captair f | 

This letter is to thank the New Mexico State Police (NMS'P) for 
it's officers' assistance in the early morning hours of March 8, 
2012 and for their continued vigilance for several days. Upon 
being advised by the Anchorage FBI office that a possible suspect 
in the abduction of Samantha Koenig was using bank ATMs near 
Interstate 10 and moving eastward from Arizona in the early 
morning hours of March 8, 2012, the Mesilla Valley Regional 
Dispatch Center was requested to ask for officers to watch ATMs 
near Interstate 10 and Interstate 10 itself for a possible 
suspect vehicle. Even though the vehicle description was vague, 
a white sedan based off the ATM photos, and the situation was 
fluid, NMSP officers watched requested locations and checked 
numerous area hotels for several days for potential matching 
vehicles as at one point Anchorage believed the suspect traveled 
at night only. 

NMSP continued to be vigilant until the Be On the Look Out (BOLO) 
was cancelled when a suspect was apprehended near Humble, Texas, 
several days later. 

The Las Cruces Office of the Federal Bureau of Investigation 
greatly appreciates NMSP's commitment and service in this matter. 



Sincerely, 


Supervisory Special Agent 





ANltr04.wpd 






U.S. Department of Justice 


# 



Federal Bureau of Investigation 


In Reply, Please Refer to 

Fi!eNa nv 

7A-AN-15642 


505 South Main, Suite 115 
Las Cruces, New Mexico 88001 
April 10, 2012 


Sheriff Todd Garrison 
542 North Motel Boulevard 
Las Cruces, New Mexico 88007 

RE: Abduction of Samantha Koenig 

Dear Sheriff Garrison: 

This 'letter is to thank the Dona Ana County Sheriff’s Office 
' (.DASO) - for it’s deputies’ assistance in the early morning hours 
ot" ! March 8, 2012 and for their continued vigilance for several 
■■daji^i*: 1 ' i: Upon being advised by the Anchorage FBI office that a 
’possible suspect in the abduction of Samantha Koenig was using 
bank ATMs near Interstate 10 and moving eastward from Arizona in 
the early morning hours of March 8, 2012, the Mesilla Valley 
Regional Dispatch Center was requested to ask for 

officers/deputies to watch ATMs near Interstate 10 and Interstate 
10 itself for' a possible suspect vehicle. Even though the 
vehicle description was vague, a white sedan based off the ATM 
photos, and the situation was fluid, many deputies responded and 
watched area ATMs and Interstate 10 and checked numerous area 
hotels for several days for potential matching vehicles as at one 
point Anchorage believed the suspect traveled at night only. 

DASO continued to be vigilant until the Be On the Look Out (BOLO) 
was cancelled when a suspect was apprehended near Humble, Texas, 
several days later. 

The Las Cruces Office of the Federal Bureau of Investigation 
greatly appreciates DASO's commitment and service in this matter. 



Sincerely, 

bg j 
b7C 


Supervisory Special Agent 


ANltrOS 


□ 






U.S. Department of Justice 


Federal Bureau of Investigation 


In Reply, Please Refer to 

FiIeNo ' ,nOi 

7A-AN-15642 ^ 

Chief Richard Williams 
Las Cruces Police Department 
217 East Pichaco 
Las Cruces, New Mexico 88001 

RE: Abdi 

Dear Chief Williams: 

This letter is to thank the Las Cruces Police Department (LCPD) 
for it's officers' assistance in the early morning hours of March 
8, 2012 and for their continued vigilance for several days. 

Upon being advised by the Anchorage FBI office that a possible 
suspect in the abduction of Samantha Koenig was using bank ATMs 
near Interstate 10 and moving eastward from Arizona in the early 
morning hours of March 8, 2012, the Mesilla Valley Regional 
Dispatch Center was requested to ask for officers to watch ATMs 
near Interstate 10 and Interstate 10 itself for a possible 
suspect vehicle. Even though the vehicle description was vague, 
a white sedan based off the ATM photos, and the situation was 
fluid, LCPD officers watched requested locations and checked 
numerous area hotels for several days for potential matching 
vehicles as at one point Anchorage believed the suspect traveled 
at night only. 

LCPD continued to be vigilant until the Be On the Look Out (BOLO) 
was cancelled when a suspect was apprehended near Humble, Texas, 
several days later. 

The Las Cruces Office of the Federal Bureau of Investigation 
greatly appreciates LCPD's commitment and service in this matter. 


505 South Main, Suite 115 
Las Cruces, New Mexico 88001 
April 10, 2012 


uction of Samantha Koenig 


ANltr03.wpd 


Sincerely, 


Supervisory Spec ial Agent 


b6 

b7C 


"2'P‘j jx<^ □ 





UNCLASSIFIED 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: DEADLINE 04/13/2012 Date: 04/11/2012 

To: Phoenix Attn: SIA [ I 

From: Anchorage 

Squad C-2 _ 

Contact: I I 

Approved By: | 1 

Drafted By: [ 

Case ID #: 7A-AN-15642 (Pending)^ 

Title: KEYESi ISRAEL 

KOENIG , SAMANTHA, TESSLA 

Synopsis: Request Phoenix Division's assistance to serve Federal 

Grand Jury Subpoena 



b6 

b7C 


Details: Anchorage Division re quests Phoenix Division's 

assistance to serve subpoena to I 

f ~ ~ ~ ~ | Subpoena will be 

delivered via FBI internal mail. 


UNCLASSIFIED 

«*f-AlUeM£};730“ 

b7! 




UNCLASSIFIED 


To: Phoenix From: Anchorage 

Re: 7A-AN-15642, 04/11/2012 


LEAD(s )i 

Set Lead 1; (Action) f 

PHOENIX 

AT PHOENIX 

Request assistance to serve Federal Grand Jury- 

Subpoena . 

♦♦ 


UNCLASSIFIED 

2 ' 





U.S. Department of Justice 


Federal Bureau of Investigation 


In Reply, Please Refer to 
File No. 


7A~AN-15642y 


/ 3 / 


505 South Main, Suite 115 
Las Cruces, New Mexico 88001 
April 10, 2012 


Resident Agent In Charge Angelica Gurrola 
Drug Enforcement Administration 
2290 East Griggs 
Las Cruces, New Mexico 88004 


RE: Abduction of Samantha Koenig 


Dear RAC Gurrola: 

This letter is to thank the D rug Enforcement Ad ministration. 

especially Special Agent (SA) I I for his *>6 

assistance in the early morning hours of March 8, 2012. SA b 7 c 

I_lwas called at approximately 4 a.m. to provide 

technical assistance in an Anchorage abduction case. He spent 
several hours researching possible vehicles that matched several 
bank ATM surveillance camera photographs of the suspect's car. 

His work helped identify and eliminate several potential matches 
and contributed to the Be On the Look Out (BOLO) that led to the 
suspect's apprehension in Humble, Texas, several days later. 

The Las Cruces Office of the Federal Bureau of Investigation 
greatly appreciates SA [ I commitment and service in 

this matter. 


Sincerely, 


Supervisory Special Agent 


ANltr02.wpd 








FD-302 (Rev. 10-6-95) 


- 1 - 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 04/10/2012 


On April 10, 201 2, at approximately 11:24am, Special 
Agent ! I received the following items of evidence 

from Evidence Custodian, Anchorage Police Department 

(APD) :- 


b6 

b7c 


1. APD cas e number 12-53 07, tag number 813502 two (2) DNA 
swabs from | | 


2. APD c ase number 12- 5307, tag number 846652 hair brush 
given by | | from vehicle; 


3. APD cas e number 12-5307, tag n umber 907189 two (2) DNA 
swabs from | | 

A copy of the APD Property and Evidence Hand Receipt has 
been placed in an PD-340 (1A) Envelope and made part of this case 
file. 


© 

□ 


investigation on 04/10/2012 at Anchorage, Alaska 


File # 7A-AN-15642 _ Date dictated N/A 

by SA| | _ 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 

0 U,,J /A z-f _ 


306-aA- 


□ 








jjlfe Accomplishment Report 

TKcomplishmeni must be reported and loaded into 
ISRM within 30 days from date of accomplishment) 


Date Preparec 
Date Loaded 
Date Loader's 


i! 25 eie& 




Initials j_ 


b7C 

b7E 


Drugs 
A Fugitive 
Bankruptcy Fraud 
Computer Fraud/Abuse 
Corruption of Public Official □ 
Money Laundering O 

Sub Invest Asst by FO(s) Qj 


I Asst. FO(s)an _ 


File Number ) 

'bth ^?AN. 15642 I 


Stat Agent Soc. Sec. No. t 

1 1 1 


Stat Agent Name 

1' It 


RA 1 Squad t 

Lufkin | TY-1 | 

Assisting Agents Soc. Sec. No. x 1 

l] I 

Namel 1 

2. 

Name: 


Investigative Assistance or Technique Used 
1. Used, but did not help 3. Helped, substantially 

Z. Helped, minimally 4. Absolutely essential 

For Sub, Invest, Assist, by other FO(s) indicate A. B, C, D for corresponding FO 
I Rate FO IAT Rale FO tAT Rate FO (AT Rate FO 



A. Complaint / information/ indictment 
[^Federal | jLocal PI International 


Check if Civil Rico Complaint □ 
Information Date:_ 


| Federal □Local □international 
Subject Priority: |7]A [~j B £Jc 


Locate Date: 
Arrest Date: 


□ Subject Resisted Arrest 

□ Subject Arrested was Armed 


□ Federal □Local 


D. Recovery I Restitution / PELP X 
PI Federal PJ Local PI Interna lional 

Recovery Date:_ 

Code •_ s Amount S_ 

Code \ 


_ ✓ Amount $ _ 


Restitution Date:_ 

□ Court Ordered □Pretrial Diversion 

Code •_✓ Amount $_ 

PELP Date:_ 

Code • _✓ Amount $ 


E, Hostages(s) Released Date:_ 


Released by: □] Terrorist □ Other 
Number of Hostages:_ 


F. Conviction 

□ Federal n Loca! Q Interna lional 
Conviction Date:_ 


Subject Description Code_• (_; 

For 6F, G, H-inctude Agency Code 

□ Felony or PI Misdemeanor 

□ Plea or □Trial 


State:_ 


. Judicial District: _ 


G.U.S. Code Violation 

Required for sections A, B, F and J 
(Federal Only) 

Titfe Section # Counts 

18 1029a2 1 


H. Sentence Date:_ 


Sentence Type:_ 

in Jail: Years— 

Suspended: Years_ 

Probation: Years_ 

Fines: $ .. 


_ Months_ 

_ Months— 
_ Months— 


I. Disruption/Dismantlement: 


Dismantlement D 


Completion of FD-515a Side 2 Mandatory 


J. Civil feko Matters'/Date 
Also m rnpttie ‘glectifil 3’ 


Other Civil Matter_ 


Judgment_!_!_ 

Judicial Outcome_ 

Amount $_ 


Suspension: Years _ 


K. Administrative Sanction Date:_ 

Subject Description Code_ 4 

Type: Length: 

□ Suspension □{permanent 


L. Asset Seizure Date:_ 


Circle below one of the three asset forfeiture: 
Admin, Civil Judicial, or Criminal 
Do not indicate $ value in Section D 


M. Acquittal/ Dismissal/ Pretrial Diversion 
(Circle one) Date:_ 


N. Drug Seizures / 


Do not indicate $ in Section D 


O. Child Victim Information 
Child located / identified Date:_ 


□Living 




P. Subject Information - Required for all blocks excluding block D (Recovery/PELP), blocks E, 1, L and N 


Name 

Race* 

Sex 

Date of Birth 

Social Security No. (if available) 

Israel Keyes 

W 

M 

01/07/1978 

127-86-4049 


• IndiclmsntsiConviclions only) 

I Stityfttf dialed to 8n LCN.AsI_ __ 

! Cofnpro(0 FD-5l5a, Sido 1stocks rrumdaiofy. F*H appropriate. 

Subject re I b 1 -a d to so OCfD/ug organlz-alion, 8 VCMO Program Nalionul GungStralogy (ergolgroui 


Comptoio FO-Slfo Stfa 1 Stocks A-C only. 


j: 8 VCMO Program National Priority loll 


x Additional information may be added by attaching another form or a plain sheet of paper for additional er 
• See codes on reverse side. 

>' Requires that an explanation be attached and loaded into ISRAA for recovery over Sim and PELP over $5 m, disruption, 'dismantlement, and df&g 


S5 m, disruption, disman 






Page 


05/04/2012 


Case Number: 306-AN-15642 
Serial No.: 133 

Does Accomplishment Involve 


Drugs.: N 

A Fugitive. ..: N 

Bankruptcy Fraud.: N 

Computer Fraud/Abuse.: N 

Corruption of Public Officials: N 
Money Laundering. : N 

Sub. Invest. Asst by Other FOs: 

Investigative Assistance or Technique Used 


FI NAN ANALYST LAB FIELD SUP UCO - NAT BACK VICT-WITN C00R 

AIRCRAFT ASST PEN REGISTERS NCAVC/VI-CAP 10 WANTED FLYR 

COMPUTER ASST PHOTO COVERGE CRIM/NS INTEL SARS 

CONSEN MONITR POLYGRAPH CRIS NEG-FED CART 

ELSUR/FISC SRCH WAR EXEC CRIS NEG-LOC ASSET FORF PRO 

ELSUR/111 SHOW MONEY ERT ASST FORF SUPPORT P 

ENG FIELD SUP SOG ASST BUTTE OSC TFOS/CTD 

ENG TAPE EXAM SWAT TEAM SAV OSC. CXS/CTD 

LEGATS ASST. TECH AG/EQUIP POC SC INFRAGARD/CYD 

EVIDNCE PURCH TEL TOLL RECS FT. MON-NRCSC OFC/CID 

INFORMANT/CW UCO-GROUP I FOR LANG ASST PPP 

LAB DIV EXAMS UCO-GROUP II NON FBI LAB EX FUSION CENTERS 


Arrest is for Federal, Local, or International (F/L/I).. : F 

Arrest Subject Priority (A/B/C). : A 

Did Subject Resist (Y/N).. : N 

Was Subject Armed (Y/N>.: N 


United States Code Violation 


Title Section Count 


18 1029 




UNCLASSIFIED 


05/04/12 16:56:53 




Report Date: 05/04/2012 b6 

AccomDate.: 03/13/2012 b7C 

Agents SOC Subject Name 


KEYES, ISRAEL 


RA Squad Task Force 

HQ C-2 

1 = Used, but did not help 

2 = Helped, Minimally 

3 = Helped, Substantially 

4 = Absolutely Essential 


b6 

b7C 

b7E 


























U.S. Department of Justice 





Federal Bureau of Investigation 


In Reply, Please Refer io 
File No. 7A-AN-15642 



April 11, 2012 


Data Mechanix 

18271 McDurmolt St. Suite B 
Irvine, CA 92614 

Attention: | | 

Data Mechanix 


b6 

b7C 


Data Mechanix has been asked to perform Media Preservation, 
Clean Room Diagnosis, Recovery and Image Services on a Western Digital 
Hard Drive S/N WMASY5815297. 

Per your conversation with CART Coordinator SA | | 

| ~] the hard drive contained in this package was not able to be 

processed by our office. We would like Data Mechanix to perform the 
necessary repairs to the hard drive in order to image the data 
contained on the hard drive and return a cloned duplicate along with 
the original back to FBI Anchorage. 

Please contact if you have any further questions or concerns 
about processing this request. 


Sincerely, 

Mary Frances Rook 
Special Agent in Charge 


By|_ 

Supervisory Special Agent 









UNCLASSIFIED 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 04/11/2012 

To: Anchorage Attn: I "1 

Evidence Control Technician 


From: Anchorage 

Squad C-2 
Contact: SA[ 


Approved By: 

Drafted By: 

' 

Case ID #: 7A-AN-15462 '(Pending) 

Title: ISRAEL KEYES; 

SAMANTHA TESSLA KOENIG - VICTIM; 

KIDNAPPING/HOMICIDE 

Synopsis: Request to send evidence to Data Mechanix for 

recovery. 

Details: In support of captioned investigation it is requested 

that the Western Digital, 500 gigabyte hard drive, serial number 
WMASY5815297, be sent to Data Mechanix for data recovery. 

Data Mechanix is an FBI approved data recovery company 
that is certified to participate in the drive 1 s evidence chain of 
custody. 

Payment for Data Mechanix will be covered by | ] 

I I unit. 



UNCLASSIFIED 









UNCLASSIFIED 


To: Anchorage From: Anchorage 
Re: 7A-AN-15462, 04/11/2012 

64 


LEAD(s): 

Set Lead 1: (Action) 

ANCHORAGE 

AT ECR 

Will mail 500 gigabyte hard drive, serial number 
WMASY5815297 (7A-AN-15642 1B15-7, Barcode E5123329) to Data 
Mechanix, 18271 McDurmolt St. Suite B, Irvine, CA 92614. 

Set Lead 2: (Action) 

ANCHORAGE 

AT EVIDENCE CONTROL CENTER 

Ship Evidence Item 1B157, one Western Digital hard drive, 
serial number WMASY5815297, to the following address; 

Data Mechanix _ 

Attn: | | 

18271 McDurmolt St. Suite B 
Irvine, CA 92614 
(949) 263-0994 


♦♦ 


UNCLASSIFIED 






ffr- A*/-f&t z-fl^ 
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18*1 (Rev-2 t,15-2011) 





Greater Houston Regional 
Computer Forensics Laboratory 


13333 Northwest Freeway 
Suite 400 
Houston, Texas 77040 



REPORT OF EXAMINATION 


To: Ho uston 



Date: March 19, 2012 

Case ID No^A-AN-15642 


b6 

b7C 


Lab No.: GH12-182 


Reference: Communication dated March 14,2012 
Ref. No.: n/a 
Title: UNSUB; 

SAMANTHA TESSLA KOENIG, VICTIM; 
KIDNAPPING 

Date specimen received: March 14 2012 


Specimens: 

One (1) unknown brand and model desktop computer connected to remote video server. 


Request: 


A request was made by SA | ~| via a service request dated March 14,2012 
for Greater Houston Regional Computer Forensics Lab (GHRCFL) to assist in 
downloading security video footage, 3/10/2012 from 0100 to 0300, from Humble 
Community bank ATM machine, located at 1515 FM 1960 East, Humble, Texas 77338. 

Opinions and Conclusions: 

None 


Page 1 of3 


All ASCLD/LAB-lnlemational 
Accredited Laboratory 
Since June 10.2009 



For Official Use Only 



Summary of Examination: 

The evidence digital video footages were downloaded using bank’s security 
software, HRDV RAS version 4.10. The footage were downloaded in two (2) one- 
hour segments due to software’s limitation. These two (2) footages were copied onto 
one (1) DVD-R, with serial number GHS001011, labeled as “Extracted video 
footages from ATM Camera (3/10/12 0100-0300) [HRDV RAS Software Ver. 4.10]”. 
Any question should be directed to the examiner. 

Details of Examination: 

The following Derivative Evidence were produced as a result of the examination: 

• One (1) 4.7 GB Adams DVD-R with serial number GH8001011, labeled as 
“Extracted video footages from ATM Camera (3/10/12 0100-0300) [HRDV 
RAS Software Ver. 4.10]”, 

The following processes were conducted: 

• One (1) unknown brand and model desktop computer connected to remote 
video server. 

The unknown brand and m odel desktop compu ter located inside Assistant 
Cashier and Operations Officer | | office was utilized to 

remote connect to the video server. Native viewing/counecting software, 
HRDV RAS version 4.10 was used to retrieve the video footage, 03/10/12 
from 0100 to 0300, and downloaded in two (2) one-hour segments: 03/10/12 
from 0100 to 0200, and 03/10/12 from 0200 to 0300. 

The retrieved video footages were copied onto one (1) 4.7 GB Adams 
DVD-R diskette, serial number GH8 001011, labeled as “Extracted video 
footages from ATM Camera (3/10/12 0100-0300) [HRDV RAS Software Ver. 
4.10]”. 

Disposition of Evidence: 


The original evidence item was returned to its owner on-site. The 4.7 GB 
DVD-R diskette with serial number GH8001011 was released to FBI evidence 
storage. 


7A-AN-15642 
GH12-182 
Page 2 of3 

For Official Use Only 




mind 


Greater Houston RCFL 
Computer Analysis Response Team 


J 


7A-AN-15642 
GH12-182 
Page 3 of 3 
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(Rev. 05-01-2008) 


UNCLASSIFIED 

FEDERAL BUREAU OF INVESTIGATION 


Precedence: 

ROUTINE 

Date: 04/19/2012 

To: Criminal 

Investigative 

Attn: Assistant Section Chief 

(ASC) 1 1 

Violent Criminal Threat 
Section (VCTS) 

Attn: Supervisory Special Aqent 

(SSA)[ 1 

Behavioral Analysis Unit 
(BAU-2), National Center 
for Analysis of Violent 
Crime (NCAVC) 

CIRG 



From: Anchorage 

Squad C-2 

Cont act: SA[ 


Approved By: 


Drafted By: 


Case ID #: *^06-AN-15642 (Pending) 

Title: CHANGED 

ISRAEL KEYES; 

SAMANTHA TESSLA KOENIG - VICTIM, 

ET AL; 

SERIAL KILLINGS - VIOLENT CRIMINAL 

Synopsis: Change title and classification of captioned matter. 

Previous Title: Title marked "Changed" to reflect re¬ 
classification of captioned matter as serial killing case. Title 
previously carried as "ISRAEL KEYES; SAMANTHA TESSLA KOENIG - 
VICTIM; KIDNAPPING, ANCHORAGE, ALASKA, 02/01/2012." 

Administrative: Reference numerous telephonic contacts between 

Anchorage Division, representatives of Violent Criminal Threat 
Section (VCTS) and Behavioral Analysis Unit 2 (BAU-2), National 
Center for Analysis of Violent Crime (NCAVC) since initiation of 
captioned matter. 

Details: On 02/03/2012, the Anchorage Police Department (APD) 
requested technical assistance from the FBI in the investigation 
of the robbery and disappearance of Samantha Koenig, who was an 
18-year old female resident of Anchorage, Alaska. Surveillance 
video taken from Koenig's place of employment and surrounding 
locations appeared to indicate that Koenig was.robbed and 
abducted from the Anchorage coffee stand where she was working on 


UNCLASSIFIED 


-hlh 

ekaiifb^ 





3D6.-AA-te6.4Q;) 4Q- 




UNCLASSIFIED 


To: Criminal Investigative From: Anchorage 

Re: 306-AN-15642, 04/19/2012 


the evening of 02/01/2012. APD led extensive efforts to locate 
Koenig and pursued numerous leads over the next several weeks, 
but Koenig was not located nor were her abductor(s) identified. 

On the evening of 02/24/2012, Koenig's boyfriend 
received a text message from her cellular telephone, which 
provided the location of a demand note in a local Anchorage park. 
APD seized this note along wit h what appeared to be a photograph 
I [ Koenig. Also displayed in this 

photograph was the front page of the Anchorage Daily News from 
02/13/2012. The note demanded $30,000.00 be placed on a VISA 
debit card, issued by a local Credit Union. The FBI began 
providing additional assistance with this matter following the 
receipt of the demand note. 

On 02/28/2012, 1 [ deposited $5,000 into 

the bank account indicated in the ransom note. Over the next two 
weeks, approximately six withdrawals were made from the ransom 
account, using the aforementioned VISA debit card in Alaska, 
Arizona, New Mexico and Texas. APD and FBI investigators tracked 
these withdrawals, which were well planned and executed, and the 
Anchorage Division coordinated near real-time responses to these 
incidents, which led to the identification of the subject's 
vehicle, physical description, clothing and direction of travel 
along the Interstate 10 corridor. Continued close coordination 
between Anchorage and Southwest Border divisions and local law • 
enforcement led to the issuance of a BOLO, which resulted in the 
apprehension of Israel Keyes in Lufkin, Texas on 03/13/2012. 

Keyes was subsequently charged and transported back to 
Alaska, where confessed to the armed kidnapping, assault and 
murder of Samantha Koenig. Keyes provided extremely detailed 
informat ion regarding the Koenig k idnapping, including the 
location| |which was recovered by an FBI 

forensic dive team from below the ice on Matanuska Lake on 
04/02/2012. Several subsequent interviews of Keyes resulted in 
his confession to the armed kidnapping, carjacking and murder of 
William and Lorraine Currier of Essex, Vermont, as well as., the 
commission of a residential arson and an armed takeover bank 
robbery (separate incidents) in Texas, between June 2011 and 
February 2012. Investigators have confirmed numerous elements of 
Keyes' information, including the disappearance of the Curriers 
and the armed bank robbery. Keyes also provided locations for 
the Currier's bodies and the murder weapon, which were disposed 
of at separate sites in Vermont and upstate New York. The search 
for this evidence, some of which appears to have been excavated 
to a regional landfill in rural Vermont, is ongoing. However, 
due to the accuracy of Keyes' information and initial 
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To: Criminal Investigative From: Anchorage 
Re: 306-AN-15642, 04/19/2012 


investigative follow-up, it is strongly believed that most, if 
not all of this'evidence, including the Currier's bodies, will be 
recovered. 


Furthermore, Keyes has repeatedly alluded to numerous 
other crimes he has committed throughout the United States and 
other international locations, including additional murders and 
violent acts, which cover at least the past 14 years. However, 
he has been negotiating with the local U.S. Attorney's Office 
(USAO) to receive the death penalty, and Keyes has been unwilling 
to reveal the full extent of his crimes, until he has some' 
assurance that he will be executed. Based on the aforementioned 
information and the high degree of corroboration achieved during 
follow-up investigation, the investigative team and prosecutors 
all strongly believe Keyes assertions, including his reported 
serial kidnappings and murders. Keyes has repeatedly asserted 
that he did not have any accomplices or co-conspirators, and to 
date, the evidence appears to support that. 

Anchorage Division has been in contact with the Violent 
Criminal Threat Section (VCTS) and the Behavioral Analysis Unit 2 
(BAU-2), National Center for the Analysis of Violent Crime 
(NCAVC), throughout this investigation. Based on these contacts 
and the aforementioned information, both units/sections concur 
with the pursuit of this matter as a serial killing case. 
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To: Criminal Investigative From: Anchorage 

Re: 306-AN-15642, 04/19/2012 


Set Lead 1: (Info) 

CRIMINAL INVESTIGATIVE 
AT WASHINGTON. DC 
Review and clear. 

Set Lead 2: (Info) 

CIRG 

AT OUANTICO, VA 
Review and clear. 
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UNCLASSIFIED 

FEDERAL BUREAU OF INVESTIGATION 


Precedence : PRIORITY 


Dates 04/27/2012 


To: Laboratory Attn: Evidence Control Center. 

DNA 
COD IS 
Firearms 


From: Anchorage 

C-! - 

Contact: SA|_ 

Approved By: 

Drafted By: _ 

Case ID #: 306-AN-15642 (Pending) 

Title: ISRAEL KEYES; 

SAMANTHA TESSLA KOENIG-VICTIM; 

ET AL; 

SERIAL KILLINGS - VIOLENT CRIMINAL THREAT 



b6 

b7C 


Synopsis: To request laboratory examinations. 

Package Copy: Being forwarded under separate cover are items 
1B24 (bar code E5123093), 1B25 (bar code E5123094) and 1B183 (bar 
code E5123461). 

Details: On 02/01/2012, the victim, Samantha Koenig, was 

abducted from her place of employment, Common Grounds coffee 
stand in Anchorage, Alaska. On 03/13/2012, the subject, Israel 
Keyes, was arrested in Lufkin, Texas. Keyes had two weapons in 
his vehicle (items 1B24 and 1B25) at the time of his arrest. 

Keyes has been interviewed on multiple occasions and has admitted 
to killing Koenig and provided details about the abduction and 
homicide. In addition, Keyes admitted to killing two other 
individuals in Vermont and eluded to his involvement in other 
homicides over the past fourteen years. It is unknown at this 
point if evidence from other unsolved homicides has been 
recovered and possibly entered into CODIS or NIBIN. Keyes 
provided agents with information about firearms caches in New 
York and agents have recovered these weapons. Keyes also advised 
he has weapons caches in other parts of the United States. 
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To: Laboratory From: Anchorage 
Re: 306-AN-15642, 04/27/2012 


Investigators believe these weapons were likely used in 
homicides. 


The following items of evidence are being sent to the 
FBI Laboratory for analysis: 

1B24 (bar code E5123093) Taurus .22 long rifle 9 shot 

revolver, blued, unloaded, serial number CY51304; 

1B25 (bar code E5123094) Smith and Wesson, Model SW40V, 

.40 caliber semi-automatic handgun, serial number 

PBA6901, no magazine, unloaded; 

1B183 (bar code E5123461)Known DNA sample from Israel 

Keyes 

It is requested that the DNA sample from Keyes be 
entered into the CODIS database. 

It is requested that items 1B24 and 1B25 be test-fired 
to obtain known specimens for comparison and entered into NIBIN 
for comparison against evidence from other shooting incidents. 

Questions regarding captioned case and r equest and/or 
re sults fr om the requested exams can be s ent to SA | 

SA | | can be reached at | | 
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To: Laboratory From: Anchorage 

Re:, 306-AN-15642, 04/27/2012 


LEAD(s): 

Set Lead Is (Action) 

LABORATORY 

AT OUANTICO, VA 

The FBI Laboratory is requested to conduct the 
requested analyses on the submitted items of evidence. 

♦♦ 
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^AO 93 (Rev. 12/03) Search’ Warrant 


United States District Court 

_ District of _Alaska 


In the Matter of the Search of 

(Name, address or brief description of person or property to be searched) 

SEARCH WARRANT 

Email account israelkeyes@yahoo.com that is stored 
at Premises Controlled by Yahoo!, Inc. 

Case Number: 2/ / / J?/" 


TO: _ S/A Jolene Goeden, FBI _and any Authorized Officer of the United States 

Affidavit(s) having been made before me by _ S/A Joiene Goeden, FBI _who has reason to believe 

Affiant 

that □[] on the person of, or 0Qon the premises known as (name, description and/or location) 

See Attachment A, which is incorporated by reference, 


in the _ Northern _District of _ California _there is now 

concealed a certain person or property, namely (describe the person or property) 

See Attachment B, Section il, which is incorporated by reference. 


I am satisfied that the affidavits) and any record testimony establish probable cause to believe that the person or property so described 
is now concealed on the person or premises above-described and establish grounds for the issuance of this warrant. 

YOU ARE HEREBY COMMANDED to search on or before _ 3/25/2012 _ 

Date 

(not to exceed 10 days) the person or place named above for the person or property specified, serving this warrant and making the 
search 13 in the daytime — 6:00 AM to 10:00 P.M. □ at anytime in the day or night as I find reasonable cause has been 
established and if the person or property be found there to seize same, leaving a copy of this warrant and receipt for the person 
or property taken, and prepare a written inventory of the person or property seized and promptly return this warrant to 

_ , r>S.- _as required by law. 

U.S. Magistrate Judge (Rule 41(0(4)) 


Ci r tA-~ / oO( J V • S & <3 /v\ at 

Date and Time Issued 

JOHN D. ROBERTS 

U.S. Magistrate Judge 


and State —^ s /j 0 hrt D. Roberts, USMJ 
1 I c; .hiring 






RETURN Case Number: 


DATE WARRANT RECEIVED DATE AND TIME WARRANT EXECUTED 

INVENTORY MADE IN THE PRESENCE OF 


3:12-mj-131-JDR 


COPY OF WARRANT AND RECEIPT FOR ITEMS LEFT WITH 

Y^aOO Cqtvv\ 1. "Tecxjm _ 


INVENTORY OF PERSON OR PROPERTY TAKEN PURSUANT TO THE WARRANT 

£6> — 1 ©-to 3jZ7(ZOiZ-. 



CERTIFICATION 


I swear that this inventory is a true anfl detailed account of the person or property taken by me on the warrant, 

/s/ Signature Redacted _ 


Jolene'Ooeden, FBI 


Subscribed, sworn to, and returned before me this date. 


/s/Scott A. Oravec, USMJ 

Signature Redacted 


JOHN D. ROBERTS, U.S. Magistrate Judge 


Date 






Attachment A 


Place to be Searched 

This warrant applies to information associated with the Yahoo! account 
israeIkeyes@yahoo.com that is stored at premises owned, maintained, controlled, or operated 
by Yahoo! Inc, a company headquartered at 701 First Avenue, Sunnyvale, California 94089. 


(REST OF PAGE INTENTIONALLY LEFT BLANK) 





Attachment B 


Particular Things to be Seized 
I. Information to be disclosed by Yahoo! Inc. 

Yahoo! Inc. is required to disclose the following to the government for the Yahoo! account 
israeIkeyes@yahoo.com to the extent that the materials are within Yahoo! Inc. possession, 
custody, or control: 

1. The contents of any communication (including drafts, deleted communications, and 
communication attachments) and file stored by or for the account and any associated 
accounts and any information associated with those communications or files, such as the 
source and destination email addresses or IP addresses. 

2. All records and other information relating to the account and any associated accounts 
including, the following: 

a. Subscriber names, user names, screen names, or other identities; 

b. Mailing addresses, residential addresses, business addresses, email addresses, and 
other contact information; 

c. Length of service (including start date) and types of services utilized; 

d. Records of user activity for any connections made to or from the account, 
including the date, time, length, and method of connections, data transfer volume, 
user name, and source and destination Internet Protocol address(es); 

e. Telephone or instrument number or other subscriber number or identity, including 
temporarily assigned network address; 

f. Means and source of payment for the account (including any credit card or bank 
account numbers) and billing records; 

g. Correspondence and other records of contact by any person or entity about the account; 

h. any other records or evidence relating to the account. 


II. 


Information to be seized by the government 






All of the following records and information located in the materials described in Section I that 
constitute evidence or instrumentalities of the crime of 18 U.S.C. §§ 1029(a)(5) (Fraud and 
Related Activity in Connection with Access Devices), 1201 (Kidnapping), and 1202(b) (Ransom 
Money). 

a. Basic user information to include when the account was opened, subscriber name, user names, 
screen names, associated email addresses, physical descriptors, and physical address, 

b. The IP addresses for users of the account and the dates/times the account was accessed. 

c. Records of user activity for any connections made to or from the account, including date, 
time, length, and method of connections, data transfer volume, and user name. 

d. Any received or sent communications and information related to travel during the time 
period of October 1,2011 through March 13,2012 to include but not limited to: Alaska 
Airlines flight confirmation, trip reminders, flight changes, cancellation/re-booking 
records, and online check-in. 


. (REST OF PAGE INTENTIONALLY LEFT BLANK) 
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FBI FACSIMILE 
COVER SHEET 


PRECEDENCE 

D Immediate 

□ Priority 

□ Soutine 


CLASSIFICATION 

G Top Secret 

□ Secret 

□ Confidential 

□ Sensitive 

□ Unclassified 




Name of Office 
Facsimile Number: HC&~i I 




From: . Ffe l 


Date: 

*ue6aor! • 

tvt/-i4-U>' 


Office 

Subject: | 

&| "| &y| tkfVW 


|Va&>OdKt teAfe*' evstia- y-h^j 


Special Handling Instructions: 


Originator's Name: 


saJ 


Originator's Facsimile Number. 


Approved: 



Brief Description of Communication Faxed: 


WARNING 

Information attached to the covet sheet is U.S. Government Property. If you are not the intended recipient of this 
information, disclosure, reproduction, distribution, or use of this information is prohibited (IS.USC, § 641). Please notify the 





AO IM (Rev. 04/10) Application for a Search Wa 


United States District Court 

for the 

District of Alaska 


In the Matter of the Search of 
(Briefly describe the property to be searched 
or identify the person by name and address) 

Email account israelkeyes@yahoo.com that is Stored at 
Premises Controlled by Yahoo!, Inc. 


CaseNo. 3..' I Q - tnS - 111 - 


APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 

is 5 incorporated herein by reference 


located in the Northern District of_ California _, there is now concealed (identify the 

person or describe the property to be seised): 

See Attachment B, which is incorporated herein by reference 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
eT evidence of a crime; 

□ contraband, fruits of crime, or other items illegally possessed; 

Elf property designed for use, intended for use, or used in committing a crime; 

□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 

Code Section Offense Description 

18 U.S.C. 1029(a)(5) Access Device Fraud 

18U.S.C. 1201 Kidnapping 

18 U.S.C. 1202(b) Ransom Money 

The application is based on these facts: 

See Attached Affidavit, which is incorporated herein by reference 


Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days:_) is requested 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 

^ /s / Signature Redacted _ 

__ Jolene Goeden, FBI Special Agent _ 

Printed name and title 


Sworn to before me and signed in my presence. 

Date: 03/16/2012 

City and state: Anchorage, Alaska 


fe/John D. Roberts, USMJ. 
Signature Redacted 


Judge 's\^naturs: 
lohn D. Roberts, Magistrate Judge 


Printed name and title 
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ATTACHMENT A 


Place to be Searched 


This warrant applies to information associated with the email account 
israelkeyes@yahoo.com that is stored at premises owned, maintained, controlled, or operated by 
Yahoo!, Inc., a company headquartered at 701 First Avenue, Sunnyvale, CA, 94089. 


(REST OF PAGE INTENTIONALLY LEFT BLANK! 
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Attachment B 


3'. 


Particular Things to be Seized 
I. Information to be disclosed by Yahoo! Inc. 

Yahoo! Inc. is required to disclose the following to the government for the Yahoo! account 
israelkeyes@yahoo.com to the extent that the materials are within Yahoo! Inc. possession, 
custody, or control: 

1. The contents of any communication (including drafts, deleted communications, and 
communication attachments) and file stored by or for the account and any associated 
accounts and any information associated with those communications or files, such as the 
source and destination email addresses or IP addresses. 

2. All records and other information relating to the account and any associated accounts 
including, the following: 

a. Subscriber names, user names, screen names, or other identities; 

b. Mailing addresses, residential addresses, business addresses, email addresses, and 
other contact information; 

c. Length of service (including start date) and types of services utilized; 

d. Records of user activity for any connections made to or from the account, 
including the date, time, length, and method of connections, data transfer volume, 
user name, and source and destination Internet Protocol address(es); 

e. Telephone or instrument number or other subscriber number or identity, including 
temporarily assigned network address; 

f. Means and source of payment for the account (including any credit card or bank 
account numbers) and billing records; 

g. Correspondence and other records of contact by any person or entity about the account; 

h. any other records or evidence relating to the account. 


II. 


Information to be seized by the government 




All of the following records and information located in the materials described in Section I that 
constitute evidence or instrumentalities of the crime of 18 U.S.C. §§ 1029(a)(5) (Fraud and 
Related Activity in Connection with Access Devices), 1201 (Kidnapping), and 1202(b) (Ransom 
Money). 

a. Basic user information to include when the account was opened, subscriber name, user names, 
screen names, associated email addresses, physical descriptors, and physical address. 

b. The IP addresses for users of the account and the dates/times the account was accessed. 

c. Records of user activity for any connections made to or from the account, including date, 
time, length, and method of connections, data transfer volume, and user name. 

d. Any received or sent communications and information related to travel during the time 
period of October 1, 2011 through March 13, 2012 to include but not limited to: Alaska 
Airlines flight confirmation, trip reminders, flight changes, cancellation/re-booking 
records, and online check-in. 


(REST OF PAGE INTENTIONALLY LEFT BLANK) 
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CERTIFICATE OF AUTHENTICITY OF DOMESTIC BUSINESS RECORDS 
PURSUANT TO FEDERAL RULE OF EVIDENCE 902(11) 

I,_, attest, under penalties of perjury under the 

laws of the United States of America pursuant to 28 U.S.C. § 1746, that the information 
contained in this declaration is true and correct. I am employed by Yahoo!, and my official title 

is_. I am a custodian of records for Yahoo!. I state that each 

of the records attached hereto is the original record or a true duplicate of the original record in 
the custody of Yahoo!, and that I am the custodian of the attached records consisting of 
_(pages/CDs/kilobytes). I further state that: 

a. all records attached to this certificate were made at or near the time of the occurrence of 
the matter set forth, by, or from information transmitted by, a person with knowledge of 
those matters; 

b. such records were kept in the ordinary course of a regularly conducted business activity 
of Yahoo!; and 

c. such records were made by Yahoo! as a regular practice. 

I further state that this certification is intended to satisfy Rule 902(11) of the Federal 
Rules of Evidence. 


Date 


Signature 
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IN THE UNITED STATES DISTRICT COURT . 
FOR THE DISTRICT OF ALASKA 


IN THE MATTER OF THE SEARCH OF 
EMAIL ACCOUNT israelkeyes@yahoo.com 
THAT IS STORED AT PREMISES 
CONTROLLED BY YAHOO!, INC. 


Case No. 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 

I, Jolene Goeden, being first duly sworn, hereby depose and state as follows: 

INTRODUCTION AND AGENT BACKGROUND 

1. I submit this affidavit under Rule 41 of the Federal Rules of Criminal Procedure 
in support of an application for a search warrant for the email account israelkeyes@yahoo.com 
that is stored at premises owned, maintained, controlled, or operated by Yahoo!, Inc. ("Yahoo!”), 
an email provider headquartered at 701 First Avenue, Sunnyvale, CA, 94089. Pursuant to 18 
U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A) the search warrant will require Yahoo! to 
disclose to the government records and other information in its possession pertaining to the email 
account, including the content of electronic communications. 

2. The items to be searched for and seized consist of fruits, evidence and 
instrumentalities of violations of 18 U.S.C. §§ 1029(a)(5) (Fraud and Related Activity in 
Connection with Access Devices), 1201 (Kidnapping), and 1202(b) (Ransom Money). These 
items are specifically described in Attachment B, attached hereto. 

3. I am a Special Agent of the Federal Bureau of Investigation (FBI). I have been an 


FBI Special Agent since April, 2004. I am charged with investigating violations of the laws of 




the United States, collecting evidence in cases in which the United States is or may be a party in 
interest, and performing other duties imposed by law. I have been assigned to investigate most 
criminal matters within the jurisdiction of the FBI, including kidnappings, child exploitation, ' 
fraud, and other white collar crimes. 

4. The facts in this affidavit come from my personal observations, my training and 
experience, Yahool’s Law Enforcement Guide, and information obtained from other agents and 
witnesses. This affidavit is intended to show merely that there is sufficient probable cause for 
the requested warrant and does not set forth all of my knowledge about this matter. Facts not set 
forth herein are not being relied upon in reaching my conclusion that probable cause exists for 
the issuance of a search warrant, and nor do I request that this Court rely upon any facts not set 
forth herein when reviewing this affidavit in support of an application for a search warrant. 

RELEVANT STATUTES 

5. This investigation concerns the unauthorized use of an access device, specifically, 
a Credit Union One VISA debit card in the name of a known individual, herein identified as 
D.T., bearing number XXXXXXXXXXXX2851 and an identifiable security code, in violation of 
Title 18, USC, Section 1029(a)(5), Fraud and Related Activity in Connection with Access 
Devices, which provides that: 

Whoever, knowingly and with intent to defraud effects transactions with I or more access 
devices issued to another person or persons, to receive payment or any other things of 
value during any 1-year period that aggregate value of which is equal to or greater than 
$ 1 , 000 ; 

Title 18, United States Code, Section 1201 (Kidnapping), which provides that: 





Whoever unlawfully seizes, confines, inveigles, decoys, kidnaps, abducts, or carries away 
and holds for ransom or reward or otherwise any person, except in the case of a minor by 
the parent thereof, when the person is willfully transported in interstate or foreign 
commerce, regardless of whether the person was alive when transported in interstate or 
foreign commerce or uses the mail or any means, facility, or instrumentality of interstate 
or foreign commerce in committing or in furtherance of the commission of the offense; 

and Title 18, United States Code, Section 1202(b) (Ransom Money), which provides that: 

Whoever receives, possesses, or disposes of any money or other property, or any portion 
thereof, which has at any time been delivered as ransom or reward in connection with a 
violation of section 1201 of this title, knowing the same to be money or property which 
has been at any time delivered as such ransom or reward. 


INVESTIGATION 

Abduction of S.K. 

6. On 2-2-12 at about 12:39 Alaska Standard Time (AST), Duncan, the owner of the 
Common Ground Coffee stand at 630 E. Tudor, Anchorage, Alaska, contacted APD dispatch. 
Duncan was calling from Oregon, where he was vacationing. He reported that while viewing his 
internet-based security system he saw one of his employees, 18-year-old S.K., appear to be 
abducted. Duncan said he was contacted by S.K.’s father (J.K.) and boyfriend (D.T.), who had 
been unable to locate her. This contact prompted Duncan to review his security video which 
showed an unknown man climb through the window of the coffee stand at about 20:00 AST on 
2-1-12 while S.K. was working. The video appears to show S.K. retreating a short distance and 
raising her hands in an apparent sign of submission to the man who subsequently climbed into 
the coffedlsbn^wB^d S.K. and escorted her away from the scene. The abductor climbed 
through thfe^n^w/kito the coffee stand without any significant difficulty. He appeared to be 
significantly taller than S.K., who is 5’4" tall, but due to the limited lighting and quality of the 
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video, a more accurate estimate of his height has not been made. The robber/abductor appeared 
to have a medium to large build and athletic movements. 

7. At the time of her abduction, S.K. was wearing a dark-colored jacket, a green shirt 
with light-colored stripes on the sleeves, a thin dark-colored bracelet, dark-colored pants, and 
dark-colored shoes. At the time of her abduction, S.K. was also believed to be in possession of a 
carabineer with three keys and possibly a white lanyard, a medium-to-large size leopard print 
purse, and a black cellular telephone with sliding keyboard. S.K. is a white female adult, 
approximately 5'4" tall, 150 pounds, 18 years old, with shoulder-length brown hair and brown 
eyes. 

8. Video surveillance appeared to show S.K.'s robber/abductor wearing a dark- 
colored, possibly hooded, jacket, dark-colored glasses, a dark-colored face mask, dark-colored 
gloves, dark-colored pants; and dark-colored shoes. He appeared to be carrying a white coffee 
cup and a dark-colored bag. Although to date no weapon has been conclusively identified in the 
surveillance videos that captured this robbery/abduction, the scene was generally poorly lit and 
the robber/abductor was not always fully visible. Furthermore, S.K.'s reaction appeared to be 
consistent with someone who was confronted or threatened with a weapon. In addition, during 
separate subsequent interviews, both S.K.’s father and boyfriend adamantly indicated that S.K. 
was very strong-willed and would not have complied with a robber or abductor's demands, 
unless she had been threatened with a weapon. 

9. Surveillance video from a nearby Home Depot at approximately 19:54 AST on 2- 
1-12 showed a white Chevrolet extended cab truck roll through the Home Depot parking lot and 




park just east of an International House of Pancakes. From a distance, the surveillance showed 
an individual with a black garment and hat get out of the truck and walk westbound through the 
parking lot towards Denali St., cross it, get on the sidewalk, walk southbound on Denali St. to 
Tudor Rd., cross Tudor Rd. at the intersection, and, finally, exit the frame. The individual’s 
travel was in the direction of the Common Ground Coffee stand, from which S.K. was abducted. 
One minute later, the video surveillance footage from Common Ground Coffee stand showed the 
individual who abducted S.K. approach from the direction of the man in the Home Depot video. 
Approximately two minutes after S.K, and her abductor exited the frame of the Common 
Ground Coffee stand video footage, two persons appearing to match S.K. and her abductor again 
entered the frame of the Home Depot video footage, this time walking back towards the location 
where the white Chevrolet truck was originally parked. The Home Depot video then showed the 
two people approach the passenger side door of the Chevrolet truck. It then showed the person 
who appeared to be S.K. enter the passenger side of truck. The other individual then walked 
around truck, entered the driver’s side, and drove out of the surveillance video’s frame. As 
described below, police have now identified KEYES’ residence and located a white Chevrolet 
truck registered to him at that residence. This white Chevrolet truck belonging to KEYES 
appears to match the vehicle in the Home Depot surveillance footage, although KEYES’ truck 
has several toolboxes and a ladder rack fastened with removable bolts to the truck bed, and these 
items do not appear on the truck in the Home Depot video. In subsequent interviews with 
multiple neighbors of KEYES, the neighbors consistently related that the toolboxes and ladder 
rack were recently added, and were not present on KEYES’ truck at the time of the kidnapping. 




10. During an interview on 02-02-2012, D.T. (S.K.’s boyfriend) said he went to the 
coffee stand on 2-1-12 at about 20:33 AST to give her a ride home but the stand appeared to be 
closed and she was not there. D.T. further reported to law enforcement that on 02/02/2012, at 
approximately 03:00 AST, he observed an unknown male adult wearing a ski mask and dark 
clothing going through the vehicle he shared with S.K. D.T. did not alert authorities to the 
burglary of the vehicle at that time. 

11. When D.T. was asked where his ATM debit card was by APD Detectives several 
days after the abduction, he indicated he had left it in the vehicle he shared with S.K. This 
vehicle had been seized by APD on 02-02-2012 and searched pursuant to a State of Alaska 
search warrant. The debit card referenced above was not located during the search; however law 
enforcement did not notify D.T. of this fact. D.T. indicated that his debit card was a Credit Union 
1 VISA debit card (VISA debit card) bearing XXXXXXXXXXXX285I, expiration 01/15, and 
that he did not give his VISA debit card to anyone else or give anyone permission to use it. The 
card is thus believed to have been stolen from D.T.'s vehicle at the time D.T. observed the 
vehicle break-in. D.T. further related that S.K.’s driver’s license had also been in his vehicle. 
That driver’s license was missing when searched for on 02-02-2012, indicating that it also was 
stolen at that time. I know that a driver’s license is generally necessary to leave the State of 
Alaska by airplane, road or ferry, due to established interstate (or international in the case of 
travel to/from Alaska via the Alaska-Canada Highway) travel requirements. Furthermore, due to 
Alaska’s unique geographic location, the difficulty of traveling by road through northern Canada 
in winter, and the lengthy periods generally associated with traveling to/from Alaska by ferry, 





commercial airlines are the most common and popular mode of interstate travel to/from Alaska, 
especially during the winter. 

Ransom Note and Transfer of Funds to “Ransom Account” 

12. On 02-24-2012, at 19:56 AST, D.T. received the following text on his cell phone 
907-231-9835 from S.K.’s cell phone 907-884-8370 - “Conner park sign under pic of albert aint 
she purty”. J.K. (S.K.’s father) contacted law enforcement officers and relayed the information. 
At the request of APD Detectives, at approximately 20:18 AST, APD Patrol Officers arrived at 
Conner Park located on the southeast comer of Jewel Lake Road and International Airport Road 
in Anchorage, Alaska. J.K.and D.T. were already present. Attached to the park sign, below a 
flyer for a lost dog named “Albert,” was a ziploc bag which contained a folded piece of paper. 

13. On one side of the piece of paper, there was a photograph of S.K. with silver duct 
tape around her mouth and chin. She appeared to be wearing eye liner, and a light-colored, 
latex-gloved hand and lightly complected, muscular arm was holding S.K.’s hair. In the upper 
part of the photo was an Anchorage Daily Newspaper determined to be the issue released on 
Monday, February 13,2012. 

14. On the reverse side of the piece of paper was a ransom note which demanded 
$30,000. The note included the 16-digit card number of the debit card belonging to D.T., which 
he had reported stolen on the night of the kidnapping, as summarized above. This debit card 
number is correlated to a bank account number held by D.T. and S.K. The note demanded that 
$30,000.00 be deposited into that account and indicated that the writer of the note intended to 
withdraw money at regular intervals over the coming days, and in locations other than Alaska. 




Specifically, it said, “I may not use the card much in ak due to small pop but as I will be leaving 
soon I will be using it all over,” The note further gave an indication that S.K. had been moved 
from Alaska, stating that “she did almost get away thice. once on tudor and once in the desert, 
must be losing my touch.” I know from research, training, and experience, and discussions with 
law enforcement officers familiar with Alaska that there are no areas in Alaska commonly 
referred to and known to be "deserts.” Many such areas do exist in Arizona, New Mexico and 
Texas. Subsequent analysis of the demand note by the FBI Laboratory revealed that it was typed 
with a typewriter that used a carbon ribbon, and that the aforementioned picture on the back of 
the demand note was printed with an inkjet printer. 

15. On 02-29-2012, at approximately 16:55 AST, J.K. contacted APD Detectives and 
told them he was withdrawing $5,000.00 from the reward account set up for S.K. at Denali 
Alaskan Federal Credit Union, and he intended to deposit it in the ransom fund, which was an 
account held by Credit Union 1. Pursuant to a State search warrant obtained by APD Detective 
Joseph Barth on 02-25-2012, investigators were informed that $5,000.00 was deposited in the 
Credit Union 1 account indicated on the ransom note, (the account attached to the Credit Union I 
VISA debit card [VISA debit card] bearing XXXXXXXXXXXX28 51, expiration 01/15 issued 
to D.T).at 17:45 AST on 02-29-2012). 

Unauthorized use of Credit Union 1 VISA debit card 

16. On 02-29-2012 at 22:13 AST, an unknown person utilizing D.T.'s Credit Union 1 
debit card attempted to withdraw $600.00 in US Currency from the account indicated on the 
ransom note. The attempted withdrawal took place at the Automatic Teller Machine (ATM) 
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located at the Alaska USA bank at 4000 Credit Union Drive in Anchorage, Alaska. Because the 
attempted amount was over the $500.00 daily limit, the withdrawal was declined. Surveillance 
video in the area of the ATM revealed a male dressed in a black hooded sweatshirt and black 
pants, operating a light-colored SUV, arrived in the parking lot of the Sea Galley restaurant 
across the street. After parking the SUV, the male exited and quickly walked across the street to 
the area of the Alaska USA ATM. The SUV was later determined by the FBI to be a silver 
Nissan Xterra of a model between the years 2005 and 2012. As noted below, police have now 
determined that KEYES' girlfriend owns a silver 2007 Nissan Xterra. 

17. On 02-29-2012 at 23:56 AST, $500.00 in US Currency was withdrawn from the 
ATM at the Denali Alaskan Federal Credit Union located at 3020 Minnesota Drive in 
Anchorage, Alaska. The debit card utilized to withdraw the money was the same Credit Union 1 
debit card issued to D.T. Surveillance video obtained of the area revealed this withdrawal was 
conducted by an unknown male with a muscular appearance wearing a dark-colored, possibly 
hooded, jacket with a light-colored design or paint spatter on the left chest and front, and light- 
colored lettering, including possibly "CORPS" across the back shoulders; clear or light-colored 
glasses; a gray face mask; gray gloves; dark-colored pants; and light-colored shoes. 

18. During the course of the investigation. Detective Blanton and Officer Pierce of 

APD obtained surveillance footage from businesses surrounding the Alaska USA, which is 

located on Credit Union Drive in Anchorage, Alaska. Immediately before the withdrawal, a 

hidden surveillance camera located at the Sea Galley at 4101 Credit Union Drive in Anchorage, 

Alaska captured a similarly dressed male park in the extreme southwest comer of the Sea Galley 

parking lot driving a silver Nissan Xterra. From the surveillance video, the male appeared to exit 
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the vehicle and walk westbound across the street to the Alaska USA and return a short while 


later. Both the male’s appearance and timing are commensurate with him being the person who 
attempted to withdraw the money. 

19. On 03-01-2012 at approximately 00:28 AST, $500.00 in US currency was 
withdrawn from the ATM at the Alaska USA located at 7701 Debarr Road in Anchorage, 

Alaska. As with the prior two transactions, the debit card utilized to withdraw the money was 
the Credit Union 1 debit card issued to D.T, 

20. On 03-07-2012 at approximately 21:57 AST, $400.00 in US currency was 
withdrawn from the ATM at the Western Bank located at 200 West Rex Allen Road in Willcox, 
Arizona. The debit card utilized to withdraw the money was the Credit Union 1 debit card issued 
to D.T. Surveillance video on the ATM showed the individual using the debit card for the 
withdrawal was a white male dressed in a gray hooded jacket or sweatshirt, glasses, a gray face 
mask, gray gloves, dark-colored pants, and light-colored shoes, and appeared to be driving a late 
model white Ford Focus sedan. 

21. On 03-07-2012 at approximately 23:24 AST, there was an attempted $400.00 
withdrawal at the Western Bank located at 711 Main Street in Lordsburg, New Mexico, using 
D.T.’s Credit Union 1 debit card (the same card referenced in prior paragraphs.) The withdrawal 
was declined by the ATM as it would have put the debit card over the daily withdrawal limit. 

At 23:25 AST, at the same ATM, a balance inquiry was conducted on the account utilizing the 
debit card. The balance shown was $3,598.91. At 23:26 AST, $80.00 was withdrawn from the 
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account utilizing the debit card. Surveillance video on the ATM showed the individual using the 
debit card wore similar clothing to the first ATM withdrawal in Arizona. 

22. On 3-9-2012 at approximately 23:23 AST, there was a $483.00 withdrawal made 
at an ATM at Houston Community Bank, 1515 FM 1960 Bypass East, Humble City, Texas. 
Initial review of the surveillance video from the ATM appeared to show that the individual using 
the debit card wore similar clothing to that worn during the two aforementioned ATM 
withdrawals in Arizona and New Mexico. 

23. On 03-11 -2012 at approximately 23:47 AST, there was a $480.00 withdrawal at 
the People’s State Bank located at 5850 Hwy 59 South, Shepherd, Texas using D.T.’s Credit 
Union 1 debit card (the same card referenced in prior paragraphs.) Surveillance video on the 
ATM showed the individual using the debit card wore similar clothing to the first ATM 
withdrawal in Arizona, as well as the subsequent withdrawals in New Mexico and Texas. 

Stop of the White Ford Focus 

24. On 03/13/2012, at approximately 11:00 Central Time (CT), Texas Ranger Steven 
Rayburn, while in the company of FBI Agent Gannoway, was notified by Texas Department of 
Public Safety (DPS) Highway Patrol Corporal Bryan Henry (Corporal Henry) that a white Ford 
Focus sedan bearing Texas license plate DH4N930 was observed parked at the Quality Inn & 
Suites (QIS), 4306 South First Street, Lufkin, Texas, which is a short drive from Shepherd, 
Texas. 

25. On 03/13/2012, at approximately 11:15 CT, Ranger Rayburn and FBI Agent 

Gannoway responded to the QIS, at which time the FBI Agent conducted a walk-by and visual 
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inspection of the white Ford Focus. The FBI Agent noted a bar-code sticker on the driver's side 
back passenger window consistent with stickers applied to rental vehicles. The FBI Agent also 
noted numerous items of clothing, trash and other debris in plain sight within the vehicle, 
including what appeared to be a girl's or woman's pink item of clothing. Ranger Rayburn caused 
a Texas license plate database search to be conducted which revealed the white 2012 Ford Focus 
was registered to PV Holding Corporation, 9603 John Saunders Road, San Antonio, Texas. DPS 
Criminal Investigative Division (CID) Lieutenant Mickey Hadnot (Lieutenant Hadnot) 
maintained surveillance on the Ford Focus. 

26. On 03/13/2012, at approximately 11:30 CT, Lieutenant Hadnot reported to 
Ranger Rayburn that a white male adult exited room 215 of the QIS, placed some items into the 
trunk of the aforementioned white Ford Focus, and departed the scene alone, driving the white 
Ford Focus. FBI Agent Deb Gannaway had previously obtained from the QIS front desk 
manager an "in house list" of all occupants of the QIS on the night of 03/12/2012, which 
reflected room 215 was rented by ELIJAH KEYES for the time period 03/09/2012 through 
03/13/2012. 

27. On 03/13/2012, at approximately 11:45 CT, Corporal Henry conducted a traffic 

stop on the white Ford Focus sedan based in part on FBI Agent Deb Gannaway’s suspicion that 

the vehicle was the same vehicle used in the Arizona, New Mexico, and Texas ATM 

withdrawals, as well as Corporal Henry's assessment that the driver of the vehicle was traveling 

in excess of the posted speed limit. Upon FBI Agent Gannaway’s arrival at the car stop location, 

Corporal Henry provided to FBI Agent Gannoway Alaska Driver's License number 7268639, in 

the name of ISRAEL KEYES, which KEYES had provided to Corporal Henry. KEYES told 
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Corporal Henry that he flew from Anchorage, Alaska, to Las Vegas, Nevada, on 03/07/2012, and 
that he rented the white Ford Focus at the Las Vegas airport, driving to his present location over 
the course of the ensuing week. KEYES provided to FBI Agent Gannoway a copy of his car 
rental agreement, which corroborated his statement that he had rented the car at the Las Vegas, 
Nevada, airport on 03/07/2012. KEYES was unable to describe the route he drove from Nevada 
to Texas, but stated he was in Lufkin, Texas, to attend his sister's wedding in Wells, Texas. 
KEYES said he "probably" paid for fuel throughout his travels from Nevada to Texas with cash. 
Ranger Rayburn reported that there was a pair of large white tennis shoes partially pushed under 
the driver’s seat of the Ford Focus, which Ranger Rayburn could plainly see through the window. 
During questioning Ranger Rayburn, KEYES became increasingly agitated and uncooperative, 
and he refused to allow Ranger Rayburn to inspect his wallet (which was in his pocket) or his 
vehicle. KEYES became unusually nervous and began to sweat profusely, in spite of the slightly 
cool weather and the tank top which he was wearing at the time. KEYES expressed to FBI 
Agent Gannoway that if he was going to be kept in the area for a longer period of time, he 
desired to call his brother (who has KEYES' daughter in a separate car) and notify him of same. 
FBI Agent Gannoway suggested KEYES make that call. A short time later, the 2012 Ford Focus 
was transported to and secured at the Lufkin, Texas, Police Department. 

28. Based on the aforementioned observations, including the fact that the rented Ford 
Focus matched the description of the vehicle utilized in the ATM withdrawals in Arizona, New 
Mexico and Texas, KEYES' arrival in Las Vegas, Nevada, and his subsequent travel from 
Nevada to Texas very likely resulting in KEYES traveling through Arizona on or about 
03/07/2012 (the date of a $400.00 ATM withdrawal in Arizona) and New Mexico on or about 
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03/08/2012 (the date of an $80.00 ATM withdrawal in New Mexico), KEYES' appearance 
closely matching the description of the white male adult observed in videos of the above- 
described ATM withdrawals, KEYES' own admission that he lived in the Anchorage, Alaska, 
area, KEYES' Alaska driver's license reflecting an Anchorage, Alaska, address, the white tennis 
shoes under the driver's seat matching the description of the shoes worn by the white male adult 
observed in the videos of the above-described ATM, as well as other observations, Corporal 
Henry and FBI Agent Gannoway placed KEYES under arrest. Ranger Rayburn, in FBI Agent 
Gannoway’s presence, searched KEYES’ wallet, revealing a VISA ATM/Debit card bearing 
account number XXXXXXXXXXXX2851, expiration date 01/15, in the name of D.T. This card 
is linked to the “ransom account” identified above, from which the withdrawals and attempted 
withdrawals summarized above were made. 

Discovery of KEYES’ White Chevrolet Truck 

29. APD Detectives discovered that ISRAEL KEYES listed a mailing address of 
3705 Arctic Blvd. #2891 in Anchorage, Alaska, on 07-18-2011, which is the Mail Cache. APD 
Detectives also discovered that KEYES listed a residential address of 2456 Spurr Lane in 
Anchorage, Alaska, as of 07-18-2011. 

30. On 03-13-2012 at approximately 10:30 AST, members of the APD Special 
Assignment Unit went to KEYES’ home address at 2456 Spurr Lane in Anchorage, Alaska. No 
one answered repeated knocks on the door. Per APD Sergeant Redick, there were fresh tire 
impressions in the snow in the driveway of the address that appeared as if a vehicle had been 
parked there as recently as the morning of 03-13-2012. 






31. There was also a white Chevrolet pickup truck parked in the driveway of the 
address. The truck had a large toolbox in the bed and a ladder rack on top. The bolts securing 
those items were removable and appeared to have been recently added. The license plate on the 
truck was Alaska license plate FTC990, relating to a white 2004 Chevrolet Silverado, registered 
to ISRAEL KEYES at 2456 Spurr Lane in Anchorage, Alaska. The white Chevrolet truck 
appeared to match the vehicle appearing in the Home Depot surveillance video, as summarized 
above. Further, Detectives eventually contacted KEYES’ girlfriend and discovered that she 
drives a 2007 Nissan Xterra' which matched the general description of the vehicle used by an 
individual who appeared to attempt to use the stolen debit card on 2-29-12, as summarized 
above. 

Discovery of KEYES’ Computer Use and Use of Yahoo Account 

32. KEYES' girlfriend, who also lives at his residence, was interviewed on 
approximately March 14, 2012. She indicated KEYES was out of Alaska. She also indicated 
that KEYES owned a laptop computer and that his computer was not in the residence. 

33. Alaska Airlines provided travel records for KEYES pursuant to a Federal Grand 
Jury Subpoena that was issued to them on March 14, 2012. In reviewing the returns for this 
subpoena, travel records were found showing KEYES and his young daughter traveled to 
Houston on February 2 , 2012. KEYES was originally scheduled to return on February 14, 2012 
but changed the ticket to return on February 17, 2012. The ticket was booked online October 1, 
2011 and an email confirmation was sent on the same date. The return ticket was changed to 
February 17,2012 and an email confirmation was sent on 2/15/2012. The notes for this 
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transaction indicate the email confirmation was sent to an email address believed to belong to 
A.K., the mother of KEYES’ daughter. However, the tickets were booked using KEYES’ credit 
card. A.K.does not reside in the state of Alaska and it is likely she had to forward the email 
confirmation to KEYES so that he would know the dates/times of travel. 

34. In reviewing the returns for this subpoena, travel records were also found showing 
KEYES and his young daughter traveled to Las Vegas on March 6, 2012 via Alaska Airlines. 
This ticket was booked online and he provided an email address with the reservation. The notes 
section of the travel records indicated the email address provided was israelkeyes@yahoo.com. 
The records also indicated an email confirmation was sent to israelkeyes@yahoo.com on March 
1 , 2012 . 


TECHNICAL BACKGROUND 

35. In my training and experience, I have learned that Yahoo! provides a variety of 
on-line services, including electronic mail (“email”) access, to the general public. Yahoo! allows 
subscribers to obtain email accounts at the Internet domain name yahoo.com. Subscribers obtain 
an account by registering with Yahoo! During the registration process, Yahoo! asks subscribers 
to provide basic personal information. 


36. In general, an email that is sent to a Yahoo! subscriber is stored in the subscriber’s 
“mail box” on Yahoo! servers until the subscriber deletes the email. If the subscriber does not 
delete the message, the message can remain on Yahoo! servers indefinitely. 

37. When the subscriber sends an email, it is initiated at the user’s computer, 

transferred via the Internet to Yahoo! ’s servers, and then transmitted to its end destination. 
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Yahoo! often saves a copy of the email sent. Unless the sender of the email specifically deletes 
the email from the Yahoo! server, the email can remain on the system indefinitely. 

38. A sent or received email typically includes the content of the message, source and 
destination addresses, the date and time at which the email was sent, and the size and length of 
the email. If an email user writes a draft message but does not send it, that message may also be 
saved, but it may not include all of these categories of data. 

39. A Yahoo! subscriber can also store files, including emails, address books, contact 
or buddy lists, calendar data, and other files, on servers maintained and/or owned by Yahoo!. 

40. Subscribers to Yahoo! might not store on their home computers copies of the 
emails stored in their Yahoo! account. This is particularly true when they access their Yahoo! 
account through the web, or if they do not wish to maintain particular emails or files in their 
residence. 

41. In general, email providers like Yahoo! ask each of their subscribers to provide 
certain personal identifying information when registering for an email account. This information 
can include the subscriber’s full name, physical address, telephone numbers and other identifiers, 
alternative email addresses, and, for paying subscribers, means and source of payment (including 
any credit or bank account number). 

42. Yahoo! retains certain transactional information about the creation and use of 

each account on their systems. This information includes the date on which the account was 

created, records of log-ins, the status of the account (including whether the account is inactive or 

closed), and other log files that reflect usage of the account. In addition, Yahoo! maintains a 
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record of the Internet Protocol address (“IP address”) used to register the account and the IP 
addresses associated with particular logins to the account. Because every device that connects to 
the Internet must use an IP address, IP address information can help to identify which computers 
or other devices were used to access the email account. 

43. In some cases, email account users will communicate directly with an email 
service provider about issues relating to the account, such as technical problems, billing 
inquiries, or complaints from other users. Email providers typically retain records about such 
communications, including records of contacts between the user and the provider’s support 
services, as well records of any actions taken by the provider or user as a result of the 
communications. 

44. In my training and experience, evidence of who was using a Yahoo! email 
account may be found in address books, contact lists, email in the account, and attachments to 
emails, including pictures and files. 

45. I know it to be common for airlines to send out multiple reminders of trips, 
requests for online check in, cancellation and re-booking information, and other information 
related to air travel to the email accounts of airline passengers. 

INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 

46. I anticipate executing this warrant under the Electronic Communications Privacy 

Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A), by using the warrant 

to require Yahoo! to disclose to the government the records and other information (including the 

content of communications) particularly described in Section I of Attachment B. Upon receipt of 
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the information described in Section I of Attachment B, government-authorized persons will 
review that information to locate the items described in Section II of Attachment B. 

47. This search warrant authorizes the government to retain after its review all of the 
items described in Section I of Attachment B. This authorization is justified in this case, in part, 
because: 

a. The investigation is not yet complete and accordingly, it is not possible to predict 
all possible defendants against whom evidence from the e-mail account and 
associated records might be used. That evidence might be used against persons 
who have no possessory interest in the account’s communications and associated 
records, or against persons yet unknown. Those defendants might be entitled to a 
copy of communications and associated records in discovery that are not within 
the scope of Attachment B, Section II (e.g., written statements made by a 
defendant and sent to the account). Retention of all of the account's 
communications and associated information assures that it will be available to all 
parties, including those known now and those later identified; 

b. The government’s possession of these materials will not deprive Yahoo! or the 
owner of the account from possessing the same items; 

c. Should the execution of the warrant uncover data that may later need to be 
introduced into evidence during a trial or other proceeding, the authenticity and 
the integrity of the evidence and the government’s forensic methodology may be 
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contested issues. Retaining all of the items produced by Yahoo! can help the 
Court resolve such claims; 


d. Yahoo! is not closing the israelkeyes@yahoo.com account. Accordingly, ongoing 
access and use of the israelkeyes@yahoo.com account by the account’s subscriber 
may alter or eliminate items stored in the account. Thus, retaining the items 
produced by Yahoo! assures preservation of these records; and 

e. The act of destroying items produced by Yahoo! could create an opportunity for a 
defendant to claim that the destroyed items contained evidence favorable to him. 
Maintaining a copy of the items would permit the Court and the government, 
through an additional warrant if necessary, to investigate such a claim. 

CONCLUSION 

48. Based on my training and experience, and the facts as set forth in this affidavit, 
there is probable cause to believe that on the computer systems in the control of Yahoo! there 
exists fruits, evidence and instrumentalities of violations of 18 U.S.C. §§ 1029(a)(5) (Fraud and 
Related Activity in Connection with Access Devices), 1201 (Kidnapping), and 1202(b) (Ransom 
Money). 

49. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. 18 U.S.C. §§ 2703(a), (b)(1)(A) & 
(c)(1)(A). Specifically, the Court is “a district court of the United States ... that - has 
jurisdiction over the offense being investigated.” 18 U.S.C. § 271 l(3)(A)(i). 
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50. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 

Respectfully submitted, 

fsl Signature Redacted 

JOLENfGOEDEN _ " 

Special Agent 

Federal Bureau of Investigation 


Sworn to and subscribed before me 
this M day of March, 2012. 

fe/John D. Roberts, USMJ 
^_Signature Redacted 

united States maSstrate judge 






IN THE UNITED STATES DISTRICT COURT 


FOR THE DISTRICT OF ALASKA 


In the Matter of the Search of: 

IN THE MATTER OF THE SEARCH 
OF EMAIL ACCOUNT 
israelkeyes@yahoo.com THAT IS 
STORED AT PREMISES 
CONTROLLED BY YAHOO!, INC. 


) CaseNo. 3: 

) 

) ORDER GRANTING MOTION 
) TO SEAL SEARCH WARRANT, 
) APPLICATION, AFFIDAVIT 
) FOR SEARCH WARRANT, 

) ATTACHMENTS AND 
) RETURN 
) 

) FILED UNDER SEAL 


The United States requests that the Search Warrant, Application, Affidavit, 
Attachments and the Return filed in the above-captioned case be sealed. 

This Court finds that the need for secrecy to protect the ongoing 
investigation and potential witnesses outweighs the public’s right to inspect and 


copy judicial records and documents. 

IT IS HEREBY ORDERED that: 

The Search Warrant, Application, Affidavit and Attachments filed in the 
above-captioned case, and the Return to be filed, be sealed until further order of 
this Court. 

Further, the United States Attorney’s Office is directed to notify the Court 


/ 


// 




as soon as the need for secrecy passes by filing a motion to unseal records. 
DATED this 16th day of March, 2012, at Anchorage, Alaska. 





iERTS 
States Magistrate Judge 




KAREN L. LOEFFLER 
United States Attorney 

CRAIG M. WARNER 

Assistant U.S. Attorney 

Federal Building & U.S. Courthouse 

222 West Seventh Avenue, #9, Room 253 

Anchorage, Alaska 99513-7567 

Phone: (907) 271-5071 

Fax: (907)271-1500 

E-mail: craig.wamer@usdoj.gov 


IN THE UNITED STATES DISTRICT COURT 


FOR THE DISTRICT OF ALASKA 


In the Matter of the Search of: 

IN THE MATTER OF THE SEARCH 
OF EMAIL ACCOUNT 
israelkeyes@yahoo.com THAT IS 
STORED AT PREMISES 
CONTROLLED BY YAHOO!, INC. 


) Case No. J?/ /£ OQ 

) 

) MOTION TO SEAL SEARCH 
) WARRANT, APPLICATION, 

) AFFIDAVIT FOR SEARCH 
) WARRANT, ATTACHMENTS, 

) AND RETURN 

) 

) FILED UNDER SEAL 


COMES NOW the United States of America, by and through undersigned 


counsel and hereby moves for an order sealing the Search Warrant, Application 
and Affidavit and Returns for the search warrant issued in the above-captioned 
matter until further order of this Court. 


The government makes this motion to protect the investigative integrity of 
the present case. The investigation of this case is ongoing and disclosure of the 




• • 

issuance of the search warrant could result in destruction of evidence and could 
also impact officer, witness and victim safety. 

Historically, courts have recognized a “general right to inspect and copy 
public records and documents, including judicial records and documents.” 
Kamakana v. City and County of Honolulu. 447 F.3d 1172, 1178 (9th Cir. 2006) 
citing Nixon v. Warner Communications. Inc.. 435 U.S. 589, 597 & n.7 (1978). 
Nonetheless, access to judicial records is not absolute. A narrow range of 
documents is not subject to the right of public access at all because the records 
have “traditionally been kept secret for important policy reasons.” Id citing 
Times Mirror Co. V. United States. 873 F.2d 1210, 1219 (9th Cir. 1989). Ninth 
Circuit case law has identified two categories of documents that fall into this 
category: grand jury transcripts and warrant materials in the midst of a pre¬ 
indictment investigation. Id Parties seeking to seal a judicial record not 
traditionally kept secret must provide compelling reasons to the court for doing so. 
Id. In general, “compelling reasons” are those sufficient to outweigh the public’s 
interest in disclosure. Id at 1179. 

Based on the foregoing, the government respectfully requests this Court 

enter the attached proposed Order sealing said search warrant, Application and 

IN THE MATTER OF THE SEARCH OF EMAIL ACCOUNT israelkeyes@yahoo.com THAT 
IS STORED AT PREMISES CONTROLLED BY YAHOO!, INC. 
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Affidavit for Search Warrant, the Returns and this Motion and Order until said 
time as the government has time to review the information contained therein and 
act upon. 

RESPECTFULLY SUBMITTED this 16th day of March, 2012, in 
Anchorage, Alaska. 


KAREN L. LOEFFLER 
United States Attorney 


s/ Craig _ 

Assistarii U.S. Attorney 

Federal Building & U.S. Courthouse 

222 West Seventh Avenue, #9, Room 253 

Anchorage, Alaska 99513 

Phone: (907) 271-5071 

Fax: (907) 271-1500 

E-mail: craig.wamer@usdoj.gov 


In re E-mail account daxteny@hotmail.com 
3:11 -mj -00020-JDR 
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' ^ AO 93 (Rev. 12/03) Search Warrant 

United States District Court 

_ District of _ Maska 


In the Matter of the Search of 

{Name, address or brief description of person or property to be searched) 

Samsung cellphone, black in color, slider type. 
Model# SCH-R631. Possible S/N 80015743 (this 
number is on the back of the phone but it does not 
indicate it as a S/N) 


/W*,<w SEARCH WARRANT 


Case Number: 




3:12-M J-134-JDR 


TO: _ S/A Jolene Goeden, FBI _and any Authorized Officer of the United States 

Affidavit(s) having been made before me by _ S/A Jolene Goeden, FBI _who has reason to believe 

Affiant 

that □(] on the person of, or (2[]on the premises known as (name, description and/or location) 

See Attachment A, which is incorporated by reference, 


in the ' _District of _ Alaska _there is now 

concealed a certain person or property, namely (describe the person or property) 

See Attachment B, which is incorporated by reference. 


I am satisfied that the affidavits) and any record testimony establish probable cause to believe that the person or property so described 
is now concealed on the person or premises above-described and establish grounds for the issuance of this warrant. 

YOU ARE HEREBY COMMANDED to search on or before _ 3/30/2012 _ 

. Date 

(not to exceed 10 days) the person or place named above for the person or property specified, serving this warrant and making the 
search 0 in the daytime — 6:00 AM to 10:00 P.M. □ at anytime in the day or night as I find reasonable cause has been 
established and if the person or property be found there to seize same,- leaving a copy of this warrant and receipt for the person 
or property taken, and prepare a written inventory of the person or property seized and promptly return this warrant to 

_ TO A _;_ as required by law. 

U.S. Magistrate Judge (Rule 41(f)(4)) 


JOHN D. ROBERTS 

U.S. MAGISTRATE JUDGE 


at 


;/s/John D. Roberts, USMJ 

./signature Redacted 


“' 1 " 


Name and Title of Judge 








‘ AO 93 








ATTACHMENT A 





The property to be searched is a Samsung cellphone, black in color, slider type. Model# 
SCH-R63 1, possible S/N 80015743 (this number is on the back of the phone but it does not 


indicate it as a S/N), currently located at non-drug evidence locker at FBI Anchorage, 101 East 
6 lh Avenue, Anchorage, Alaska 99501:-- -.. 








ATTACHMENT B 


All records and information on the Target Device identified in Attachment A that relate to 
violations of Title 18, United States Code (USC), Section 1029(a)(5) (Fraud and Related Activity- 
in Connection with Access Devices )(FRACAD); Title 18, United States Code, Section 1201 
(Kidnapping); and Title 18, United States Code, Section 1202(b) (Ransom Money), and involve 
ISRAEL KEYES, including: 


1. Evidence of who used, owned, or controlled the Target Device and evidence of 
the Target Device contacting or communicating with other cellular phones or 
electronic devices, including text messages, application data, calender entries, 
notes, call records, contact or address book entries, photos, location information, 
and Internet browser history/cache. 

2. Evidence of the times the Target Device was used. 

3. The substantive content of any text communications to or from the Target Device. 

4. Contextual information necessary to understand the evidence described in this 
attachment. 

As used above, the terms “records” and “information” include all of the foregoing items 
of evidence in whatever form and by whatever means they may have been created or stored, 
including any form of computer or electronic storage. 





ACc106 (Rev. 04/10) Application for a Search Warranv 




United States District Court 

for the 

District of Alaska 


In the Matter of the Search of ^ 

(Briefly describe the property to be searched ) / \ 

or identify the person by name and address) j Case No. 3:12-MJ-134-JDR 

Samsung cellphone, black in color, slider type. Model# ) 

SCH-R631. Possible S/N 80015743 (this number is on j 
the back of the phone but it does not indicate it as a S/N) ' 

APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that 1 have reason to believe that on the following person or property (identify the person or describe the 

(s incorporated herein by reference 


located in the _ District of_ Alaska _, there is now concealed (identify the 

person or describe the property to be seized): 

See Attachment B, which is incorporated herein by reference 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
sf evidence of a crime; 

□ contraband, fruits of crime, or other items illegally possessed; 

sf property designed for use, intended for use, or used in committing a crime; 

□ a person to be arrested'or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section 
18U.S.C, 1029(a)(5) 
18 U.S.C. 1201 
18 U.S.C. 1202(b) 


Access Device Fraud 
Kidnapping 
Ransom Money 


Offense Description 


, The application is based on these facts: . , 

See Attached Affidavit-, which is incorporated herein by reference 


sf Continued on the attached sheet. 

O Delayed notice of_days (give exact ending date if more than 30 days:_) is requested 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Sworn to before me and signed in my presence. 

Date: 03/20/2012 

City and state: Anchorage, Alaska __ 


_ /s/ Signature Redacted _ 

s signature 

Joiene G o edpn^FB fS p e cj a I Agent 

.-; P'ririiedrtadkxd&ititje. ■. 

■ ■ • ■ , • 


.. 5/s/John D. Roberts, USN1J 
■^Signature Redacted 
X. -t „ , Juagbis signature ; 

'CrnhrvF) 1 
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ATTACHMENT A 

The property to be searched is a Samsung cellphone, black in color, slider type. Model# 
SCH-R63 1, possible S/N 80015743 (this number is on the back of the phone but it does not 
indicate it as a S/N), currently located at non-drug evidence locker at FBI Anchorage, 101 East 
6 th Avenue, Anchorage, Alaska 99501. 






ATTACHMENT B 


All records and information on the Target Device identified in Attachment A that relate to 
violations of Title 18, United States Code (USC), Section 1029(a)(5) (Fraud and Related Activity 
in Connection with Access Devices )(FRACAD); Title 18, United States Code, Section 1201 
(Kidnapping); and Title 18, United States Code, Section 1202(b) (Ransom Money), and involve 
ISRAEL KEYES, including: 


1. Evidence of who used, owned, or controlled the Target Device and evidence of 
the Target Device contacting or communicating with other cellular phones or 
electronic devices, including text messages, application data, calender entries, 
notes, call records, contact or address book entries, photos, location information, 
and Internet browser history/cache. 

2. Evidence of the times the Target Device was used. 

3. The substantive content of any text communications to or from the Target Device. 

4. Contextual information necessary to understand the evidence described in this 
attachment. 

As used above, the terms “records” and “information” include all of the foregoing items 
of evidence in whatever form and by whatever means they may have been created or stored, 
including any form of computer or electronic storage. 






UNITED STATES DISTRICT COURT 
THE DISTRICT OF ALASKA 


) 

IN THE MATTER OF THE SEARCH OF ) 

SAMSUNG CELLULAR TELEPHONE, BLACK ) 
IN COLOR, SLIDER TYPE, Model# SCH-R631. ) 
Possible S/N 80015743, ) 

CURRENTLY LOCATED AT FBI ANCHORAGE) 
NON-DRUG EVIDENCE LOCKER ) 

_ ) 


AMENDED AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 

I, Jolene Goeden, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 

1. I am a Special Agent of the Federal Bureau of Investigation (FBI). I have been a 
Special Agent of the FBI since April 2004. I am charged with the duty of investigating violations 
of the laws of the United States, collecting evidence in cases in which the United States is or may 
be a party in interest, and performing other duties imposed by law. I have been assigned to 
investigate most criminal matters within the jurisdiction of the FBI, including kidnapping 
matters, fraud matters and other white collar crime. 

2. I make this affidavit in support of an application under Rule 41 of the Federal Rules of 
Criminal Procedure for a warrant to search a Samsung cellphone, black in color, slider 

type. Model# SCH-R63 1. Possible S/N 80015743 (this number is on the back of the phone but it 
does not indicate it as a S/N), further identified in Attachment A (Target Device), for the 
information identified in Attachment B. 


Case No. 3:12-mj-134-JDR 


filed under seal 
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3. As set forth herein, there is probable cause to believe that in the property to be searched 
there exists evidence of a crime, contraband, fruits of a crimes, or other items illegally possessed 
in violation of Title 18, United States Code (USC), Section 1029(a)(5) (Fraud and Related 
Activity in Connection with Access Devices )(FRACAD); Title 18, United States Code, Section 
1201 (Kidnapping); and Title 18, United States Code, Section 1202(b) (Ransom Money), as 
further described in Attachment A. 

RELEVANT STATUTES 

4. The Target Device contains evidence of and is an instrumentality used for 
violations of Title 18, USC, Section 1029(a)(5), Fraud and Related Activity in Connection with 
Access Devices, which provides that: 

Whoever, knowingly and with intent to defraud effects transactions with 1 or more access 
devices issued to another person or persons, to receive payment or any other things of 
value-during any 1-year period that aggregate value of which is equal to or greater than 
$ 1 , 000 ; 


and Title 18, United States Code, Section 1201 (Kidnaping), which provides that: 

Whoever unlawfully seizes, confines, inveigles, decoys, kidnaps, abducts, or carries away 
and holds for ransom or reward or otherwise any person, except in the case of a minor by 
the parent thereof, when the person is willfully transported in interstate or foreign 
commerce, regardless of whether the person was alive when transported in interstate or 
foreign commerce or uses the mail or any means, facility, or instrumentality of interstate 
or foreign commerce in committing or in furtherance of the commission of the offense; 


and Title 18, United States Code, Section 1202(b) (Ransom Money), which provides that:. 

Whoever receives, possesses, or disposes of any money or other property, or any portion 
thereof, which has at any time been delivered as ransom or reward in connection with a 
violation of section 1201 of this title, knowing the same to be money or property which 
has been at any time delivered as such ransom or reward. 


IDENTIFICATION OF THE DEVICE TO BE EXAMINED 






5. The property to be searched is identified in Attachment A as a 

Samsung cellphone, black in color, slider type. Model# SCH-R631. Possible S/N 
80015743 (this number is on the back of the phone but it does not indicate it as a S/N) 
currently located at the FBI Anchorage District Office, Anchorage, Alaska, in a non-drug 
evidence vault. 

6. The applied for warrant would authorize the forensic examination of the device forthe 
purpose of identifying electronically stored data particularly described in Attachment B. 


PROBABLE CAUSE 

7. The information contained below is from my personal knowledge and experience, 
information provided to me by other law enforcement personnel, or from those specific 
sources as set forth. Since this affidavit is being submitted for the limited purpose of 
seeking authorization to search a Samsung cellphone, black in color, slider type. Model# 
SCH-R631. Possible S/N 80015743 (this number is on the back of the phone but it does 
not indicate it as a S/N), I have not included each and every fact known to me regarding 
this investigation. I have set forth only the facts that I believe are necessary to establish a 
foundation to support the aforementioned request for a search warrant. 

Abduction of S.K. 

8. On 2-2-12 at about 12:39 Alaska Standard Time (AST), Duncan, the owner of the 
Common Ground Coffee stand at 630 E. Tudor, Anchorage, Alaska, contacted APD dispatch. 
Duncan was calling from Oregon, where, he was vacationing. He reported that while viewing his 
internet-based security system he saw one of his employees, 18-year-old S.K., appear to be 
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abducted. Duncan said he was contacted by S.K.’s father (J.K.) and boyfriend (D.T.), who had 
been unable to locate her. This contact prompted Duncan to review his security video which 
showed an unknown man climb through the window of the coffee stand at about 20:00 AST on 
2-1-12 while S.K. was working. The video appears to show S.K. retreating a short distance and 
raising her hands in an apparent sign of submission to the man who subsequently climbed into 
the coffee stand, robbed S.K. and escorted her away from the scene. The abductor climbed 
through the window into the coffee stand without any significant difficulty. He appeared to be 
significantly taller than S.K., who is 5'4” tall, but due to the limited lighting and quality of the 
video, a more accurate estimate of his height has not been made. The robber/abductor appeared 
to have a medium to large build and athletic movements. 

9. At the time of her abduction, S.K. was wearing a dark-colored jacket, a green 
shirt with light-colored stripes on the sleeves, a thin dark-colored bracelet, dark-colored pants, 
and dark-colored shoes. At the time of her abduction, S.K. was also believed to be in possession 
of a carabineer with three keys and possibly a white lanyard, a medium-to-large size leopard 
print purse, and a black cellular telephone with sliding keyboard. S.K. is a white female adult, 
approximately 5'4" tall, 150 pounds, 18 years old, with shoulder-length brown hair and brown ■ 
eyes. 

10. Video surveillance appeared to show S.K.'s robber/abductor wearing a dark- 
colored, possibly hooded Jacket, dark-colored glasses, a dark-colored face mask, dark-colored 
gloves, dark-colored pants; and dark-colored shoes. He appeared to be carrying a white coffee 
cup and a dark-colored bag. Although to date no weapon has been conclusively identified in the 
surveillance videos that captured this robbery/abduction, the scene was generally poorly lit and 






the robber/abductor was not always fully visible. Furthermore, S.K.'s reaction appeared to be 
consistent with someone who was confronted or threatened with a weapon. In addition, during 
separate subsequent interviews, both S.K.‘s father and boyfriend adamantly indicated that S.K. 
was very strong-willed and would not have complied with a robber or abductor's demands, 
unless she had been threatened with a weapon. 

11. Surveillance video from a nearby Home Depot at approximately 19:54 AST on 2- 
1-12 showed a white Chevrolet extended cab truck roil through the Home Depot parking lot and 
park just east of an International House of Pancakes. From a distance, the surveillance showed 
an individual with a black garment and hat get out of the truck and walk westbound through the 
parking lot towards Denali St., cross it, get on the sidewalk, walk southbound on Denali St. to 
Tudor Rd., cross Tudor Rd. at the intersection, and, finally, exit the frame. The individual’s 
travel was in the direction of the Common Ground Coffee stand, from which S.K. was abducted. 
One minute later, the video surveillance footage from Common Ground Coffee stand showed the 
individual who abducted S.K. approach from the direction of the man in the Home Depot video. 
Approximately two minutes after S.K. and her abductor exited the frame of the Common 
Ground Coffee stand video footage, two persons appearing to match S.K. and her abductor again 
entered the frame of the Home Depot video footage, this time walking back towards the location 
where the white Chevrolet truck was originally parked. The Home Depot video then showed the 
two people approach the passenger side door of the Chevrolet truck. It then showed the person 
who appeared to be S.K. enter the passenger side of truck. The other individual then walked 
around truck, entered the driver’s side, and drove out of the surveillance videos frame. As 
described below, police have now identified KEYES’ residence and located a white Chevrolet 





truck registered to him at that residence. This white Chevrolet truck belonging to KEYES 
appears to match the vehicle in the Home Depot surveillance footage, although KEYES’ truck 
has several toolboxes and a ladder rack fastened with removable bolts to the truck bed, and these 
items do not appear on the truck in the Home Depot video. 

12. During an interview on 02-02-2012, D.T. (S.K.’s boyfriend) said he went to the 
coffee stand on 2-1-12 at about 20:33 AST to give her a ride home but the stand appeared to be 
closed and she was not there. D.T. further reported to law enforcement that on 02/02/2012, at 
approximately 03:00 AST, he observed an unknown male adult wearing a ski mask and dark 
clothing going through the vehicle he shared with S.K. D.T. did not alert authorities to the 
burglary of the vehicle at that time. 

13. When D.T. was asked where his ATM debit card was by APD Detectives several 
days after the abduction, he indicated he had left it in the vehicle he shared with S.K. This 
vehicle had been seized by APD on 02-02-2012 and searched pursuant to a State of Alaska 
search warrant. The debit card referenced above was not located during the search; however law 
enforcement did not notify D.T. of this fact. D.T. indicated that his debit card was a Credit 
Union 1 VISA debit card (VISA debit card) bearing XXXXXXXXXXXX2851, expiration 
01/15, and that he did not give his VISA debit card to anyone else or give anyone permission to 
use it. The card is thus believed to have been stolen from D.T.’s vehicle at the time D.T. 
observed the vehicle break-in. D.T. further related that S.K.’s driver’s license had also been in 
his vehicle. That driver’s license was missing when searched for on 02-02-2012, indicating that 
it also was stolen at that time. I know that a driver’s license is generally necessary to leave the 
State of Alaska by airplane, road or ferry, due to established interstate (or international in the 






case of travel to/from Alaska via the Alaska-Canada Highway) travel requirements. 

Furthermore, due to Alaska’s unique geographic location, the difficulty of traveling by road 
through northern Canada in winter, and the lengthy periods generally associated with traveling 
to/from Alaska by ferry, commercial airlines are the most common and popular mode of 
interstate travel to/from Alaska, especially during the winter. 

Ransom Note and Transfer of Funds to “Ransom Account” 

14. On 02-24-2012, at 19:56 AST, D.T. received the following text on his cell phone 
907-231-9835 from S.K.’s cell phone 907-884-8370 - “Conner park sign under pic of albert aint 
she purty”. J.K. (S.K.’s father) contacted law enforcement officers and relayed the information, 
At the request of APD Detectives, at approximately 20:18 AST, APD Patrol Officers arrived at 
Conner Park located on the southeast corner of Jewel Lake Road and International Airport Road 
in Anchorage, Alaska. J.K.and D.T. were already present. Attached to the park sign, below a 
flyer for a lost dog named “Albert,” was a ziploc bag which contained a folded piece of paper. 

15. On one side of the piece of paper, there was a photograph of S.K. with silver duct 
tape around her mouth and chin. She appeared to be wearing eye liner, and a light-colored, 
latex-gloved hand and lightly complected, muscular arm was holding S.K.'s hair. In the upper 
part of the photo was an Anchorage Daily Newspaper determined to be the issue released on 
Monday, February 13,2012. 

16. On the reverse side of the piece of paper was a ransom note which demanded 
$30,000. The note included the 16-digit card number of the debit card belonging to D.T., which 
he had reported stolen on the night of the kidnaping, as summarized above. This debit card 
number is correlated to a bank account number held by D.T. and S.K. The note demanded that 





$30,000.00 be deposited into that account and indicated that the writer of the note intended to 
withdraw money at regular intervals over the coming days, and in locations other than Alaska. 
Specifically, it said, “I may not use the card much in ak due to small pop but as I will be leaving 
soon I will be using it all over.” The note further gave an indication that.S.K. had been moved 
•from Alaska, stating that “she did almost get away twice, once on tudor and once in the desert, 
must be losing my touch.” I know from research, training, and experience, and discussions with 
law enforcement officers familiar with Alaska that there are no areas in Alaska commonly 
referred to and known to be “deserts.” Many such areas do exist in Arizona, New Mexico and 
Texas. Subsequent analysis of the demand note by the FBI Laboratory revealed that it was typed 
with a typewriter that used a carbon ribbon, and that the aforementioned picture on the back of 
the demand note was printed with an inkjet printer, 

17. On 02-29-2012, at approximately 16:55 AST, J.K. contacted APD Detectives and 
told them he was withdrawing $5,000,00 from the reward account set up for S.K. at Denali 
Alaskan Federal Credit Union, and he intended to deposit it in the ransom fund, which was an 
account held by Credit Union 1. Pursuant to a State search warrant obtained by APD Detective 
Joseph Barth on 02-25-2012, investigators were informed that $5,000.00 was deposited in the 
Credit Union 1 account indicated on the ransom note, (the account attached to the Credit Union 

1 VISA debit card [VISA debit card] bearing XXXXXXXXXXXX2851, expiration 01/15 issued 
to D.T).at 17:45 AST on 02-29-2012). 

Unauthorized use of Credit Union 1 VISA debit card 

18. On 02-29-2012 at 22:13 AST, an unknown person utilizing D.T.’s Credit Union 1 
debit card attempted to withdraw $600.00 in US Currency from the account indicated on the 





• • 


ransom note. The attempted withdrawal took place at the Automatic Teller Machine (ATM) 
located at the Alaska USA bank at 4000 Credit Union Drive in Anchorage, Alaska. Because the 
attempted amount was over the $500.00 daily limit, the withdrawal was declined. Surveillance 
video in the area of the ATM revealed a male dressed in a black hooded sweatshirt and black 
pants, operating a light-colored SUV, arrived in the parking lot of the Sea Galley restaurant 
across the street After parking the SUV, the male exited and quickly walked across the street to 
the area of the Alaska USA ATM. The SUV was later determined by the FBI to be a silver 
Nissan Xterra of a model between the years 2005 and 2012, As noted below, police have now 
determined that KEYES' girlfriend owns a silver 2007 Nissan Xterra. 

19. On 02-29-2012 at 23:56 AST, $500.00 in US Currency was withdrawn from the 
ATM at the Denali Alaskan Federal Credit Union located at 3020 Minnesota Drive in 
Anchorage, Alaska. The debit card utilized to withdraw the money was the same Credit Union 1 
debit card issued to D.T. Surveillance video obtained of the area revealed this withdrawal was 
conducted by an unknown male with a muscular appearance wearing a dark-colored, possibly 
hooded, jacket with a light-colored design or paint spatter on the left chest and front, and light- 
colored lettering, including possibly "CORPS" across the back shoulders; clear or light-colored 
glasses; a gray face mask; gray gloves; dark-colored pants; and light-colored shoes. 

20. During the course of the investigation, Detective Blanton and Officer Pierce of 
APD obtained surveillance footage from businesses surrounding the Alaska USA, which is 
located, on Credit Union Drive in Anchorage, Alaska. Immediately before the withdrawal, a 
hidden surveillance camera located at the Sea Galley at 4101 Credit Union Drive in Anchorage, 
Alaska captured a similarly dressed male park in the extreme southwest comer of the Sea Galley 
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parking lot driving a silver Nissan Xterra. From the surveillance video, the male appeared to 
exit the vehicle and walk westbound across the street to the Alaska USA and return a short while 
later. Both the male’s appearance and timing are commensurate with him being the person who 
attempted to withdraw the money. 

21. On 03-01 -2012 at approximately 00:28 AST, $500.00 in US currency was 
withdrawn from the ATM at the Alaska USA located at 7701 Debarr Road in Anchorage, 

Alaska. As with the prior two transactions, the debit card utilized to withdraw the money was 
the Credit Union 1 debit card issued to D.T. 

22. On 03-07-2012 at approximately 21:57 AST, $400.00 in US currency was 
withdrawn from the ATM at the Western Bank located at 200 West Rex Allen Road in Willcox, 
Arizona. The debit card utilized to withdraw the money was the Credit Union 1 debit card 
issued to D.T. Surveillance video on the ATM showed the individual using the debit card for 
the withdrawal was a white male dressed in a gray hooded jacket or sweatshirt, glasses, a gray 
face mask, gray gloves, dark-colored pants, and light-colored shoes, and appeared to be driving a 
late model white Ford Focus sedan. 

23. On 03-07-2012 at approximately 23:24 AST, there was an attempted $400.00 
withdrawal at the Western Bank located at 711 Main Street in Lordsburg, New Mexico, using 
D.T.’s Credit Union 1 debit card (the same card referenced in prior paragraphs.) The withdrawal 
was declined by the ATM as it would have put the debit card over the daily withdrawal limit. 

At 23:25 AST, at the same ATM, a balance inquiry was conducted on the account utilizing the 
debit card. The balance shown was $3,598.91. At 23:26 AST, $80.00 was withdrawn from the 
account utilizing the debit card. Surveillance video on the ATM showed the individual using the 
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debit card wore similar clothing to the first ATM withdrawal in Arizona. 

24. On 3-9-2012 at approximately 23:23 AST, there was a $483.00 withdrawal made 
at an ATM at Houston Community Bank, 1515 FM 1960 Bypass East, Humble City, Texas. 
Initial review of the surveillance video from the ATM appeared to show that the individual using 
the debit card wore similar clothing to that worn during the two aforementioned ATM 
withdrawals in Arizona and New Mexico. 

25. On 03-11-2012 at approximately 23:47 AST, there was a $480.00 withdrawal at 
the People's State Bank located at 5850 Hwy 59 South, Shepherd, Texas using D.T.’s Credit 
Union 1 debit card (the same card referenced in prior paragraphs.) Surveillance video on the 
ATM showed the individual using the debit card wore similar clothing to the first ATM 
withdrawal in Arizona, as well as the subsequent withdrawals in New Mexico and Texas. 

Stop of the White Ford Focus 

26. On 03/13/2012, at approximately 11:00 Central Time (CT), Texas Ranger Steven 
Rayburn, while in the company of FBI Agent Deborah Gannaway, was notified by Texas 
Department of Public Safety (DPS) Highway Patrol Corporal Bryan Henry (Corporal Henry) that 
a white Ford Focus sedan bearing Texas license plate DH4N930 was observed parked at the 
Quality Inn & Suites (QIS), 4306 South First Street, Lufkin, Texas, which is a short drive from 
Shepherd, Texas. 

27. On 03/13/2012, at approximately 11:15 CT, Ranger Rayburn and Agent 
Gannoway responded to the QIS, at which time Agent Gannoway conducted a walk-by and 
visual inspection of the white Ford Focus. Agent Gannoawy noted a bar-code sticker on the 
driver's side back passenger window consistent with stickers applied to rental vehicles. Agent 
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Gannoway also noted numerous items of clothing, trash and other debris in plain sight within the 
vehicle, including what appeared to be a girl's or woman's pink item of clothing. Ranger 
Rayburn caused a Texas license plate database search to be conducted which revealed the white 
2012 Ford Focus was registered to PV Holding Corporation, 9603 John Saunders Road, San 
Antonio, Texas. DPS Criminal Investigative Division (CID) Lieutenant Mickey Hadnot 
(Lieutenant Hadnot) maintained surveillance on the Ford Focus. 

28. On 03/13/2012, at approximately 11:30 CT, Lieutenant Hadnot reported to 
Ranger Rayburn, who was in the company of Agent Gannoway, that a white male adult exited 
room 215 of the QIS, placed some items into the trunk of the aforementioned white Ford Focus, 
and departed the scene alone, driving the white Ford Focus. Agent Gannoway had previously 
obtained from the QIS front desk manager an "in house list" of all occupants of the QIS on the 
night of 03/12/2012, which reflected room 215 was rented by ELIJAH KEYES for the time 
period 03/09/2012 through 03/13/2012. 

29. On 03/13/2012, at approximately 11:45 CT, Corporal Henry conducted a traffic 
stop on the white Ford Focus sedan based in part on Agent Gannoway’s suspicion that the 
vehicle was the same vehicle used in the Arizona, New Mexico, and Texas ATM withdrawals, 
as well as Corporal Henry’s assessment that the driver of the vehicle was traveling in excess of 
the posted speed limit. Upon Agent Gannoway’s arrival at the car stop location, Corporal Henry 
provided to Agent Gannoway Alaska Driver's License number 7268639, in the name of ISRAEL 
KEYES, which KEYES had provided to Corporal Henry prior to Agent Gannoway’s arrival at • 
the scene. Corporal Henry told Agent Gannoway that KEYES informed him he flew from 
Anchorage, Alaska, to Las Vegas, Nevada, on 03/07/2012, and that he rented the white Ford 
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Focus at the Las Vegas airport, driving to his present location over the course of the ensuing 
week. KEYES provided to Agent Gannoway a copy of his car rental agreement, which 
corroborated his statement that he had rented the car at the Las Vegas, Nevada, airport on 
03/07/2012. KEYES was unable to describe to Agent Gannoway the route he drove from 
Nevada to Texas, but stated he was in Lufkin, Texas, to. attend his sister's wedding in Wells, 
Texas. KEYES told Agent Gannoway he "probably" paid for fuel throughout his travels from 
Nevada to Texas with cash. Ranger Rayburn reported to Agent Gannoway that there was a pair 
of large white tennis shoes partially pushed under the driver's seat of the Ford Focus, which 
Ranger Rayburn could plainly see through the window. During questioning by Agent Gannoway 
and Ranger Rayburn, KEYES became increasingly agitated and uncooperative, and he refused to 
allow Agent Gannoway and/or Ranger Rayburn to inspect his wallet (which was in his pocket) 
or his vehicle. KEYES became unusually nervous and began to sweat profusely, in spite of the 
slightly cool weather and the tank top which he was wearing at the time. KEYES expressed to 
Agent Gannoway that if he was going to be kept in the area for a longer period of time, he 
desired to call his brother (who has KEYES' daughter in a separate car) and notify him of same. 
Agent Gannoway suggested KEYES make that call. A short time later, the 2012 Ford Focus was 
transported to and secured at the Lufkin, Texas, Police Department. 

30. Based on the aforementioned observations, including the fact that the rented Ford 
Focus matched the description of the vehicle utilized in the ATM withdrawals in Arizona, New 
Mexico and Texas, KEYES’ arrival in Las Vegas, Nevada, and his subsequent travel from 
Nevada to Texas very likely resulting in KEYES traveling through Arizona on or about 
03/07/2012 (the date of a $400.00 ATM withdrawal in Arizona) and New Mexico on or about 





03/08/2012 (the date of an $80.00 ATM withdrawal in New Mexico), KEYES' appearance 
closely matching the description of the white male adult observed in videos of the above- 
described ATM withdrawals, KEYES' own admission that he lived in the Anchorage, Alaska, 
area, KEYES' Alaska driver's license reflecting an Anchorage, Alaska, address, the white tennis 
shoes under the driver's seat matching the description of the shoes worn by the white male adult 
observed in the videos of the above-described ATM, as well as other observations, Agent 
Gannoway instructed Corporal Henry to place KEYES under arrest. Ranger Rayburn, in Agent 
Gannoway’s presence, searched KEYES’ wallet, revealing a VISA ATM/Debit card bearing 
account number XXXXXXXXXXXX2851, expiration date 01/15, in the name of D.T. This 
card is linked to the “ransom account” identified above, from which the withdrawals and 
attempted withdrawals summarized above were made. 

Discovery of KEYES’ White Chevrolet Truck 

31. APD Detectives discovered that ISRAEL KEYES listed a mailing address of 
3705 Arctic Blvd. #2891 in Anchorage, Alaska, on 07-18-2011, which is the Mail Cache. APD 
Detectives also discovered that KEYES listed a residential address of 2456 Spurr Lane in 
Anchorage, Alaska, as of 07-18-2011. 

32. On 03-13-2012 at approximately 10:30 AST, members of the APD Special 
Assignment Unit went to KEYES’ home address at 2456 Spurr Lane in Anchorage, Alaska. No 
one answered repeated knocks on the door. Per APD Sergeant Redick, there were fresh tire 
impressions in the snow in the driveway of the address that appeared as if a vehicle had been 
parked there as recently as the morning of 03-13-2012. 
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33. There was also a white Chevrolet pickup truck parked in the driveway of the 
address. The truck had a large toolbox in the bed and a ladder rack on top. The bolts securing 
those items were removable and appeared to have been recently added. The license plate on the 
truck was Alaska license plate FTC990, relating to a white 2004 Chevrolet Silverado, registered 
to ISRAEL KEYES at 2456 Spurr Lane in Anchorage, Alaska. The white Chevrolet truck 
appeared to match the vehicle appearing in the Home Depot surveillance video, as summarized 
above. Further, Detectives eventually contacted KEYES’ girlfriend and discovered that she 
drives a 2007 Nissan Xterra, which matched the general description of the vehicle used by an 
individual who appeared to attempt to use the stolen debit card on 2-29-12, as summarized 
above. 

Discovery OF KEYES’ Computer Use and Use of Yahoo Account 

34. KEYES' girlfriend, who also lives at his residence, was interviewed on 
approximately March 14,2012. She indicated KEYES was out of Alaska. She also indicated 
that KEYES owned a laptop computer and that his computer was not in the residence. 

35. Alaska Airlines provided travel records for KEYES pursuant to a Federal Grand 
Jury Subpoena that was issued to them on March 14,2012. In reviewing the returns for this 
subpoena, travel records were found showing KEYES and his young daughter traveled to 
Houston on February 2,2012. KEYES was originally scheduled to return on February 14, 2012 
but changed the ticket to return on February 17,2012. The ticket was booked online October 1, 
2011 and an email confirmation was sent on the same date. The return ticket was changed to 
February 17, 2012 and an email confirmation was sent on 2/15/2012. The notes for this 
transaction indicate the email confirmation was sent to an email address believed to belong to 




A.K., the mother of KEYES’ daughter. However, the tickets were booked using A.K.’s credit 
card. A.K.does not reside in the state of Alaska and it is likely she had to forward the email 
confirmation to KEYES so that he would know the dates/times of travel. 

36. In reviewing the returns for this subpoena, travel records were also found showing 
KEYES and his young daughter traveled to Las Vegas on March 6,2012 via Alaska Airlines. 
This ticket was booked online and he provided an email address with the reservation. The notes 
section of the travel records indicated the email address provided was 
israelkeves@vahoo.com . The records also indicated an email confirmation was sent to 
israelkeves@vahoo.com on March 1,2012. 

Execution of Search Warrant and Discovery of Cellular Telephone Matching 
Description of Phone Belonging to S.K. 

37. On March 16,2012, law enforcement agents in Beaumont, Texas obtained a search 
warrant which authorized the search of the white Ford Focus driven by KEYES. Execution of 
that search warrant on March 17,2012 revealed numerous items, including a Samsung 
cellphone, black in color, slider type. Model# SCH-R631. Possible S/N 80015743 (this number 
is on the back of the phone but it does not indicate it as a S/N), which matched the description of 
S.K.’s cellular phone provided by S.K.’s boyfriend (per paragraph 9, S.K. is believed to have 
been carrying the phone when the kidnapping took place), and a laptop computer. 

38. In my training and experience, I know that photos from digital cameras and 
cellular phones are frequently downloaded to computers and electronic tablets, and then printed 
or stored on media devices. I also know that cellular phones, computers, electronic tablets and 
similar devices are frequently used to arrange travel and hotel reservations, rent vehicles, and 





conduct other personal business related to traveling. I also know that computers and cellular 
phones can be used to connect to the internet, which can be used to locate banks, ATM’s, hotels, 
maps, send email, draft documents, and communicate with others. I also know that storage 
devices for electronic information, or “thumb” drives, are often used to store such information 
for later use by computers, cellular phones and other media devices. I know that electronic 
records of all such uses of computers and similar electronic devices are retained within those 
devices and may be retrieved by forensic technicians. 

Interview of KEYES 

39. In an interview with defense counsel present on March 17,2012, KEYES admitted 
to using S.K.’s debit card at locations throughout the southwest United States. He also claimed 
that he received the debit card and the cellular telephone matching the description of S.K.’s 
telephone together in a plastic bag from an anonymous person, who left the plastic bag in his 
vehicle. Based on my training and experience, it appears very likely that the specifics of 
KEYES’ account of the origin of his possession of the phone and debit card is not truthful; 
however, his admission that the phone and debit card are associated with each other associates 
both items with S.K., and confirms the identification of the phone as belonging to S.K. 

40. The Device is currently in the lawful possession of the FBI. The Device came into 
the FBI possession as outlined above. Although the FBI might already have the lawful authority 
to examine the Device, I seek this additional warrant out of an abundance of caution to be 
certain that an examination of the Device will comply with the Fourth Amendment and other 
applicable laws. 
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41. The Device is currently in storage at FBI Anchorage Station, Anchorage, Alaska. 

In my training and experience, I know that the Device has been stored in a manner in which its 
contents are, to the extent material to this investigation, in substantially the same state as they 
were when the Device first came into the possession of the government. 

TECHNICAL TERMS 

42. Based on my training, my experience, and information provided to me by other 
law enforcement personnel, I use the following technical terms to convey the following 
meanings: 

a. “Storage medium”: A storage medium is any physical object upon 
which data can be stored, including a cellular telephone’s flash 
memory or other data storage components, sucji as' a !! Slff card. 

b. “Wireless telephone”: A wireless telephony for mo 6i-le;telephone, 
or cellular telephone) is a handheld wireless'devite iased for voice 
and data communication through radio signals. These telephones 
send signals through networks of transmitter/receivers, enabling 
communication with other wireless telephones or traditional “land 
line” telephones. A wireless telephone usually contains a “call 
log,” which records the telephone number, date, and time of calls 
made to and from the phone. In addition to enabling voice 
communications, wireless telephones offer a broad range of 
capabilities. These capabilities include: storing names and phone 
numbers in electronic “address books”; sending, receiving, and 
storing text messages and e-mail; taking, sending, receiving, and 
storing still photographs and moving video; storing and playing 
back audio files; storing dates, appointments, and other 
information on personal calendars; and accessing and 
downloading information from the Internet. Wireless telephones 
may also include global positioning system (“GPS”) technology 
for determining the location of the device. 

c. “Computer”: Pursuant to 18 U.S.C. § 1030(e)(1), a computer is 
“an electronic, magnetic, optical, electrochemical, or other high 
speed data processing device performing logical or storage • 




functions,’ and includes any data storage facility or 
communications facility directly related to or operating in 
conjunction with such device.” 

d. IP Address: An Internet Protocol address (or simply “IP Address”) 
is a unique numeric address used by computers on the Internet. 

An IP address is a series of four numbers, each in the range 0-255, 
separated by periods (e.g., 121.56.97.178). Every computer 
attached to the Internet must be assigned an IP address so that 
Internet traffic sent from and directed to that compuiter may be 
directed properly from its source to its destination. Most Internet 
service providers control a range of IP addresses. Some computers 
have static- that is, long-term - IP addresses, while other 
computers have dynamic - that is, frequently changed - IP 
addresses. 

e. Internet: The Internet is a global network of computers and othe 
electronic devices that communicate with each other. Due to the 
structure of the internet, connections between devices on the 
internet often cross state and international borders, even when the 
devices communicating with each other are in the same state. 

43 Based on my training, experience, and research, I know that the Target 
Device has capabilities that allow it to serve as a wireless telephone and digital camera, and may 
also function as a computer and internet browser. In my training and experience, examining data 
stored on devices of this type can uncover, among other things, evidence that reveals or suggests 
who possessed or used the device. 

ELECTRONIC STORAGE AND FORENSIC ANALYSIS 

44. The applied-for warrant would authorize the forensic examination of the 
Target Device for the purpose of identifying and seizing the electronically stored information 
particularly described in Attachment B in accordance with Federal Criminal Procedure Rule 
41(e)(2)(B) (“Warrant Seeking Electronically Stored Information”). 

45. Forensic evidence: As further described in Attachment B, this application 
seeks permission to locate not only electronically stored information that might serve as direct 
evidence of the crimes described on the warrant, but also forensic evidence that establishes how 
the Target Device was used, the purpose of its use, who used it, and when. There is probable 
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cause to believe that this forensic electronic evidence more likely than not is stored in the Target 
Device because: 


a. Data on a storage medium can provide evidence of information 
that was once on the storage medium but has since been deleted or 
edited, or of a deleted portion of the information. 

b. . Forensic evidence stored within the Target Device can also 

indicate who has used or controlled the Target Device. This “user 
attribution” evidence is analogous to the search for “indicia of 
occupancy” while executing a search warrant at a residence. 

c. A person with appropriate familiarity with how the Target Device 
works may, after examining this forensic evidence in its proper 
context, be able to draw conclusions about how electronic devices 
were used, the purpose of their use, who used them, and when. 

d. The process of identifying the exact electronically stored 
information on a storage medium that are necessary to draw an 
accurate conclusion is a dynamic process. Electronic evidence is 
not always data that can be merely reviewed by a review team and 
passed along to investigators. Whether data stored on a cellular 
telephone is evidence may depend on other information stored on 
the cellular telephone and the application of knowledge about how 
a cellular telephone operates. Therefore, contextual information 
necessary to understand other evidence also falls within the scope 
of the warrant. 

e. Further, in finding evidence of how the Target Device was used, 
the purpose of its use, who used it, and when, sometimes it is 
necessary to establish that a particular thing is not present on a 
storage medium. 

f. . Based on my knowledge, training and experience, I know that 

electronic devices can store information for long periods of time. 
Similarly, things that have been viewed via the internet are 
typically stored for some period of time on the device. This 
information can sometimes be recovered with forensics tools. 

46. Nature of examination : Based on the foregoing, and consistent with Rule 
41(e)(2)(B), the warrant I am applying for would permit the examination of the Target Device 




consistent with the warrant. The examination may require authorities to employ techniques, 
including but not limited to computer-assisted scans of the Target Device’s entire storage 
medium, that might expose many parts of the device to human inspection in order to determine 
whether it is evidence described by the warrant. 

47. Manner of execution : Because this warrant seeks only permission to 
examine a cellular telephone already in law enforcement’s possession, the execution of this 
warrant does not involve the physical intrusion onto a premises. Consequently, I submit there is 
reasonable cause for the Court to authorize execution of the warrant at any time in the day or 
night. 

48. Forensic image retention : I hereby request judicial authorization to retain 
full copy of the cellular telephone’s storage media after the review is complete (to the extent that 
this warrant does not already authorize me to retain that storage media as seized forfeitable 
property) and until further order of the Court. That judicial authorization is justified in this case 
in part because: 

a. Should the execution of the warrant uncover data that may later 
need to be introduced into evidence during a trial or other 
proceeding, the authenticity and the integrity of the evidence and 
the government’s forensic methodology may be contested issues. 
Retaining copies of seized storage media can be required to prove 
these facts. 

b. Returning the original storage medium to its owner will not allow 
for the preservation of that evidence. Even routine use of a 
cellular telephone may forever change the data it contains or 
eliminate data stored on it. 

c. Because the investigation is not yet complete, it is not possible to 
predict all possible defendants against whom evidence found on 
the storage medium might be used. That evidence might be used 
against persons who have no possessory interest in the storage 
media, or against persons yet unknown. Those defendants might 
be entitled to a copy of the complete storage media in discovery. 
Retention of the entire content of the storage medium assures that 
it will be available to all parties, including those known now and 
those later identified. 





d. The act of destroying or returning a cellular telephone could create 
an opportunity for a defendant to claim, falsely, that the destroyed 
or returned cellular telephone contained evidence favorable to 
him. Maintaining a copy of the cellular telephone’s storage 
medium would permit the government, through an additional 
warrant if necessary, to investigate such a claim. 

e. Similarly, should a defendant suggest an explanation for the 
presence of evidence on a storage medium, it may be necessary to 
investigate such an explanation by, among other things, 
re-examining the storage medium with that defense in mind. This 
may require an additional examination of the storage medium for 
evidence that is described in Attachment B but was not properly 
identified and segregated previously. 

CONCLUSION 


49. Based on my training and experience, and the facts as set forth in this affidavit, 
there is probable cause to believe that on the Lenovo B570 laptop, black in color, Model #1068, 
S/N WB036866 there exists fruits, evidence, and instrumentalities of violations of Title 18, 
United States Code (USC), Section 1029(a)(5) (Fraud and Related Activity in Connection with 
Access Devices )(FRACAD); Title 18, United States Code, Section 1201 (Kidnaping); and Title 
18, United States Code, Section 1202(b) (Ransom Money). 

50. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. §2711. 18 U.S.C. §§ 2703(a), (b)(1)(A) & 
(c)(1)(A). Specifically, the Court is “a district court of the United States ... that - has 
jurisdiction over the offense being investigated.” 18 U.S.C. § 2711(3)(A)(I). 
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51. The investigation of this case is ongoing and disclosure of the issuance of the 
search warrant could result in destruction of evidence and could also impact officer, witness and 
victim safety. Accordingly, pursuant to the case law outlined in the government’s motion to 
seal, I respectfully request that the search warrant, search warrant affidavit, attachments, and 
returns be sealed. 

PURPOSE OF AMENDED SEARCH WARRANT AND AFFIDAVIT 

52. The original affidavit in support of this search warrant contained a series of 
attribution errors. Due to a scrivener’s error, the original affidavit referred in numerous 
locations to “the affiant” or “your affiant,” as observing or taking actions in the first person, 
when in fact these observations were made and actions taken not by your affiant, but rather by 
FBI Special Agent Deborah Gannoway. This error was inadvertent, and at the time the original 
affidavit was executed, your affiant was fully aware and cognizant of all the facts asserted 
therein. Those substantive facts remain unchanged in this amended affidavit. Rather than 
personally observing or partaking in these facts, however, your affiant knew of them through 
information provided by other law enforcement personnel (including FBI Special Agent 
Gannoway), through research and through review of law enforcement reports. This affidavit 
reflects accurately the instances in which FBI Special Agent Gannoway (amongst 
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other law enforcement officers) was physically present during events. 

Further vnnr Affiant <««>»th naught. 

Isl Signature Redacted 

Special Agent Jolene Goeden 
Federal Bureau of Investigation 


SUBSCRIBED and SWORN to before me 

-- ‘""this- day , 2012. 

z/s/John D. Roberts, USNIJ ; *"*, 
v- Signature Redacted _ 

• ‘^n^ble :: Joh^D-.^QBlrtsr 
. ■ , .'•/United <State^.Magistrate Judge 
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^AO 93 {Rev, i 2/03) Search Warrant 


United States District Court 

_ District of _ Alaska 


In the Matter of the Search of 

(Name, address or brief description of person or property to be searched) 

Lenovo B570 laptop, black in coior, Model #1068, 
S/N WB03686639 


SEARCH WARRANT 


Case Number: 


vA 

3:12-MJ-135-JDR 


TO: _ S/A Jolene Goeden, FBI _and any Authorized Officer of the United States 

Affidavit(s) having been made before me by _ S/A Jolene Goeden, FBI _who has reason to believe 

Affiant 

that DO on the person of, or 0[]on the premises known as (name, description and/or location) 

See Attachment A, which is incorporated by reference, 


in the _District of Alaska _there is now 

concealed a certain person or property, namely (describe the person or property) 

See Attachment B, which is incorporated by reference. 


I am satisfied that the affidavits) and any record testimony establish probabie cause to believe that the person or property so described 
is now concealed on the person or premises above-described and establish grounds for the issuance of this warrant. 

YOU ARE HEREBY COMMANDED to search on or before _ 3/30/2012 _ 

Date 

(not to exceed 10 days) the person or place named above for the person or property specified, serving this warrant and making the 
search 0 in the daytime — 6:00 AM to 10:00 P.M. □ at anytime in the day or night as I find reasonable cause has been 
established and if the person or property be found there to seize same, leaving a copy of this warrant and receipt for the person 
or property taken, and prepare a written inventory of the person or property seized .and promptly return this warrant to 

_ "S* • _as required by law. 

U.S. Magistrals Judge (Rule 41 (f)(4)) ~~ 


NVrrc k 2 ^, 

Date and Time Issued 1 




at 


Name and Title of Judge 

JOHN D. ROBERTS 

U.S. MAGISTRATE JUDGE 



^/s/John-D.-Roberts, USMJ 
£ . Signature Redacted 

Signatar<!\j - - ~ 
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ATTACHMENT A 


The property to be searched is a Lenovo B570 laptop, black in color. Model #1068, S/N 
WB03686639, currently located at the FBI building at 101 E. 6 Ih Ave., Anchorage, Alaska, in the 
non-drug evidence locker. 





ATTACHMENT B 


# 


All records and information on the Target Device identified in Attachment A that relate to 
violations of Title 18, United States Code (USC), Section 1029(a)(5) (Fraud and Related Activity 
in Connection with Access Devices )(FRACAD); Title 18, United States Code, Section 1201 
(Kidnapping); and Title 18, United States Code, Section 1202(b) (Ransom Money), and involve 
ISRAEL KEYES since October 1, 2011, including: 


1. Evidence of who used, owned, or controlled the Target Device, including logs, 
registry entries, configuration files, saved usernames and passwords, documents - 
including but not limited to travel records, banking or other financial records, 
records indicating connection or interactions between KEYES and S.K. or 
surveillance of S.K, by KEYES, maps, driving or other geographic directions, 
Internet browser history and cache, user profiles, email, email contacts, chat logs, 
instant messages, photographs, and correspondence. 

2. Evidence of software that would allow others to control the Target Device, such 
as viruses, Trojan horses, and other forms of malicious software, as well as 
evidence of the presence or absence of security software designed to detect 
malicious software. 

3. Evidence of the lack of such malicious software. 

4. Evidence of the attachment to the Target Device electronic storage devices, such 
as thumb drives, digital cameras, cellular telephones, or similar containers for 
electronic evidence. 

5. Evidence of counter-forensic programs (and associated data) that are designed to 
eliminate data from the Target Device ,' 

6. Evidence of the times the Target Device was used. 

7. Passwords, encryption keys, and other access devices that may be necessary to 
access the Target Device . 

8. ■ Evidence indicating the use of photoshop software or similar photography 

computer programs. 

9. contextual information necessary to understand the evidence described in this 
attachment. 


As used above, the terms “records” and “information” include all of the foregoing items 
of evidence in whatever form and by whatever means they may have been created or stored, 
including any form of computer or electronic storage. 









AO J06(Rev. 04/10) Application fora Search Want 


# 




United States District Court 

for the 

District of Alaska 

In the Matter of the Search of ^ 

(Briefly describe the property to be searched ) S ' 

or identify the person by name and address) ) Case No. 3:12-MJ-135-JDR 

Lenovo B570 laptop, black in color, Model #1068, S/N ) 

WB03686639 j 

APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 

pr ^e^atMme^ e ^^f^is 'mcorp^raieti herein by reference 

located in the _ District of_ Alaska _, there is now concealed (identify the 

person or describe the property to be seized)'. 

See Attachment B, which is incorporated herein by reference 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
evidence of a crime; 

□ contraband, fruits of crime, or other items illegally possessed; 

sf property designed for use, intended for use, or used in committing a crime; 

□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 

Code Section ■ Offense Description 

18 U.S.C. 1029(a)(5) Access Device Fraud 

18 U.S.C. 1201 Kidnapping 

18 U.S.C. 1202(b) Ransom Money 

The application is based on these facts: 

See Attached Affidavit, which is incorporated herein by reference 


fif Continued on the attached sheet. 

D Delayed notice of_days (give exact ending date if more than 30 days:_) is requested 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Swom to before me and signed in my presence. 

Date: 03/20/2012 

City and state: Anchorage, Alaska 


Isl Signature Redacted 


Jolene Goeden, FBI Special Agent 


Printed name,and title 


/s/John D. Roberts, USMJ 
..Signature Redacted . 


Rot __ ft t c Judge 


J’rintedhgme and'iit'!ff' rf ? 











ATTACHMENT B 


All records and information on the Target Device identified in Attachment A that relate to 
violations of Title 18, United States Code (USC), Section 1029(a)(5) (Fraud and Related Activity 
in Connection with Access Devices )(FRACAD); Title 18, United States Code, Section 1201 
(Kidnapping); and Title 18, United States Code, Section 1202(b) (Ransom Money), and involve 
ISRAEL KEYES since October 1,2011, including: 


1. Evidence of who used, owned, or controlled the Target Device, including logs, 
registry entries, configuration files, saved usernames and passwords, documents - 
including but not limited to travel records, banking or other financial records, 
records indicating connection or interactions between KEYES and S.K, or 
surveillance of S..K, by KEYES, maps, driving or other geographic directions, 
Internet browser history and cache, user profiles, email, email contacts, chat logs, 
instant messages, photographs, and correspondence. 

2. Evidence of software that would allow others to control the Target Device, such 
as viruses, Trojan horses, and other forms of malicious software, as well as 
evidence of the presence or absence of security software designed to detect 
malicious software. 

3. Evidence of the lack of such malicious software. 

4. Evidence of the attachment to the Target Device electronic storage devices, such 
as thumb drives, digital cameras, cellular telephones, or similar containers for 
electronic evidence. 

5. Evidence of counter-forensic programs (and associated data) that are designed to 
eliminate data from the Target Device . 

6. Evidence of the times the Target Device was used. 

7. Passwords, encryption keys, and other access devices that may be necessary to 
access the Target Device . 

8. Evidence indicating the use of photoshop software or similar photography 
computer programs. 

9. contextual information necessary to understand the evidence described in this 
attachment. 

As used above, the terms “records” and “information” include all of the foregoing items 
of evidence in whatever form and by whatever means they may have been created or stored, 
including any form of computer or electronic storage. 






UNITED STATES DISTRICT COURT 
THE DISTRICT OF ALASKA 


> A 

IN THE MATTER OF THE SEARCH OF ) Case No. 3:12-mj-l 35-JDR 

LENOVO B570 LAPTOP, BLACK IN COLOR, ) 

Model #1068 S/NWB03686639, CURRENTLY ) 

LOCATED AT FBI ANCHORAGE NON-DRUG ) Filed under seal 
EVIDENCE LOCKER ) 

_ ) 

AMENDED AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 

I, Jolene Goeden, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 

1. I am a Special Agent of the Federal Bureau of Investigation (FBI). I have been a 
Special Agent of the FBI since April 2004. I am charged with the duty of investigating violations 
of the laws of the United States, collecting evidence in cases in which the United States is or may 
be a party in interest, and performing other duties imposed by law. I have been assigned to 
investigate most criminal matters within the jurisdiction of the FBI, including kidnaping matters, 
fraud matters and other white collar crime. 

2. I make this affidavit in support of an application under Rule 41 of the Federal 
Rules of Criminal Procedure for a warrant to search a Lenovo B570 laptop, black in color, Model 
#1068, S/N WB03686639, further identified in Attachment A (Target Device), for the 
information identified in Attachment B. 

3. As set forth herein, there is probable cause to believe that in the property to be 
searched there exists evidence of a crime, contraband, fruits of a crimes, or other items illegally 
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possessed in violation of Title 18, United States Code (USC), Section 1029(a)(5) (Fraud and 
Related Activity in Connection with Access Devices )(FRACAD); Title 18, United States Code, 
Section 1201 (Kidnapping); and Title 18, United States Code, Section 1202(b) (Ransom Money), 
as further described in Attachment A. 

RELEVANT STATUTES 

4. The Target Device contains evidence of and is an instrumentality used for 
violations of Title 18, USC, Section 1029(a)(5), Fraud and Related Activity in Connection with 
Access Devices, which provides that: 

Whoever, knowingly and with intent to defraud effects transactions with 1 or more access 
devices issued to another person or persons, to receive payment or any other things of 
value during any 1-year period that aggregate value of which is equal to or greater than 
$ 1 , 000 ; 

and Title 18, United States Code, Section 1201 (Kidnaping), which provides that: 

Whoever unlawfully seizes, confines, inveigles, decoys, kidnaps, abducts, or carries away 
and holds for ransom or reward or otherwise any person, except in the case of a minor by 
the parent thereof, when the person is willfully transported in interstate or foreign 
commerce, regardless of whether the person was alive when transported in interstate or 
foreign commerce or uses the mail or any means, facility, or instrumentality of interstate 
or foreign commerce in committing or in furtherance of the commission of the offense; 

and Title 18, United States Code, Section 1202(b) (Ransom Money), which provides that:. 

Whoever receives, possesses, or disposes of any money or other property, or any portion 
thereof, which has at any time been delivered as ransom or reward in connection with a 
violation of section 1201 of this title, knowing the same to be money or property which 
has been at any time delivered as such ransom or reward. 


IDENTIFICATION OF THE DEVICE TO BE EXAMINED 
5. The property to be searched is identified in Attachment A as a Lenovo B570 
laptop, black in color. Model #1068, S/N WB03686639, currently located at the FBTsAnchorage 
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District Office, Anchorage, Alaska, in a non-drug evidence vault. 

6, The applied for warrant would authorize the forensic examination of the device 
for the purpose of identifying electronically stored data particularly described in Attachment B, 

PROBABLE CAUSE 

7. The information contained below is from my personal knowledge and experience, 
information provided to me by other law enforcement personnel, or from those specific sources 
as set forth. Since this affidavit is being submitted for the limited purpose of seeking 
authorization to search a Lenovo B570 laptop, black in color, Model #1068, S/N WB03686639,1 
have not included each and every fact known to me regarding this investigation. I have set forth 
only the facts that I believe are necessary to establish a foundation to support the aforementioned 
request for a search warrant. 

Abduction of S.K. 

8. On 2-2-12 at about 12:39 Alaska Standard Time (AST), Duncan, the owner of 
the Common Ground Coffee stand at 630 E. Tudor, Anchorage, Alaska, contacted APD 
dispatch. Duncan was calling from Oregon, where he was vacationing. He reported that while 
viewing his internet-based security system he saw one of his employees, 18-year-old S.K., 
appear to be abducted. Duncan said he was contacted by S.K.’s father (J.K.) and boyfriend 
(D.T.), who had been unable to locate her. This contact prompted Duncan to review his security 
video which showed an unknown man climb through the window of the coffee stand at about 
20:00 AST on 2-1-12 while S.K. was working. The video appears to show S.K. retreating a short 
distance and raising her hands in an apparent sign of submission to the man who subsequently 
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climbed into the coffee stand, robbed S.K. and escorted her away from the scene. The abductor 
climbed through the window into the coffee stand without any significant difficulty. He 
appeared to be significantly taller than S.K., who is 5'4" tall, but due to the limited lighting and 
quality of the video, a more accurate estimate of his height has not been made. The 
robber/abductor appeared to have a medium to large build and athletic movements. 

9. At the time of her abduction, S.K. was wearing a dark-colored jacket, a green, 
shirt with light-colored stripes on the sleeves, a thin dark-colored bracelet, dark-colored pants, 
and dark-colored shoes. At the time of her abduction, S.K. was also believed to be in possession 
of a carabineer with three keys and possibly a white lanyard, a medium-to-large size leopard 
print purse, and a black cellular telephone with sliding keyboard. S.K. is a white female adult, 
approximately 5'4" tall, 150 pounds, 18 years old, with shoulder-length brown hair and brown . 
eyes. 

10. Video surveillance appeared to show S.K.’s robber/abductor wearing a dark- 
colored, possibly hooded, jacket, dark-colored glasses, a dark-colored face mask, dark-colored 
gloves, dark-colored pants; and dark-colored shoes. He appeared to be carrying a white coffee 
cup and a dark-colored bag. Although to date no weapon has been conclusively identified in the 
surveillance videos that captured this robbery/abduction, the scene was generally poorly lit and 
the robber/abductor was not always fully visible. Furthermore, S.K.’s reaction appeared to be 
consistent with someone who was confronted or threatened with a weapon. In addition, during 
separate subsequent interviews, both S.K.'s father and boyfriend adamantly indicated that S.K. 
was very strong-willed and would not have complied with a robber or abductor's demands, 
unless she had been threatened with a weapon. 
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11. Surveillance video from a nearby Home Depot at approximately 19:54 AST on 2- 

1-12 showed a white Chevrolet extended cab truck roll through the Home Depot parking lot and 
park just east of an International House of Pancakes. From a distance, the surveillance showed 
an individual with a black garment and hat get out of the truck and walk westbound through the 
parking lot towards Denali St., cross it, get on the sidewalk, walk southbound on Denali St. to 
Tudor Rd., cross Tudor Rd. at the intersection, and, finally, exit the frame. The individual’s 
travel was in the direction of the Common Ground Coffee stand, from which S.K. was abducted. 
One minute later, the video surveillance footage from Common Ground Coffee stand showed the 
individual who abducted S.K, approach from the direction of the man in the Home Depot video. 
Approximately two minutes after S.K. and her abductor exited the frame of the Common 
Ground Coffee stand video footage, two persons appearing to match S.K. and her abductor again 
entered the frame of the Home Depot video footage, this time walking back towards the location 
where the white Chevrolet truck was originally parked. The Home Depot video then showed the 
two people approach the passenger side door of the Chevrolet truck. It then showed the person 
who appeared to be S.K. enter the passenger side of truck. The other individual then walked 
around truck, entered the driver’s side, and drove out of the surveillance video’s frame. As 
described below, police have now identified KEYES’ residence and located a white Chevrolet 
truck registered to him at that residence. This white Chevrolet truck belonging to KEYES 
appears to match the vehicle in the Home Depot surveillance footage, although KEYES’ truck 
has several toolboxes and a ladder rack fastened with removable bolts to the truck bed, and these 
items do not appear on the truck in the Home Depot video. 

' 12. During an interview on 02-02-2012, D.T. (S.K.’s boyfriend) said he went to the 
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coffee stand on 2-1-12 at about 20:33 AST to give her a ride home but the stand appeared to be 
closed and she was not there. D.T. further reported to law enforcement that on 02/02/2012, at 
approximately 03:00 AST, he observed an unknown male adult wearing a ski mask and dark 
clothing going through the vehicle he shared with S.K. D.T. did not alert authorities to the 
burglary of the vehicle at that time. 

13. When D.T. was asked where his ATM debit card was by APD Detectives several 
days after the abduction, he indicated he had left it in the vehicle he shared with S.K. This 
vehicle had been seized by APD on 02-02-2012 and searched pursuant to a State of Alaska 
search warrant. The debit card referenced above was not located during the search; however law 
enforcement did not notify D.T. of this fact. D.T. indicated that his debit card was a Credit 
Union 1 VISA debit card (VISA debit card) bearing XXXXXXXXXXXX2851, expiration 
01/15, and that he did not give his VISA debit card to anyone else or give anyone permission to 
use it. The card is thus believed to have been stolen from D.T.'s vehicle at the time D.T. 
observed the vehicle break-in. D.T. further related that S.K.’s driver’s license had also been in 
his vehicle. That driver’s license was missing when searched for on 02-02-2012, indicating that 
it also was stolen at that time. I know that a driver’s license is generally necessary to leave the 
State of Alaska by airplane, road or ferry, due to established interstate (or international in the 
case of travel to/ffom Alaska via the Alaska-Canada Highway) travel requirements. 
Furthermore, due to Alaska’s unique geographic location, the difficulty of traveling by road 
through northern Canada in winter, and the lengthy periods generally associated with traveling 
to/ffom Alaska by ferry, commercial airlines are the most common and popular mode of 
interstate travel to/ffom Alaska, especially during the winter. 
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Ransom Note and Transfer of Funds to “Ransom Account” 


14. On 02-24-2012, at 19:56 AST, D.T. received the following text on his cell phone 
907-231-9835 from S.K.’s cell phone 907-884-8370 - “Conner park sign under pic of albert aint 
she purty”. J.K. (S.K.’s father) contacted law enforcement officers and relayed the information. 
At the request of APD Detectives, at approximately 20:18 AST, APD Patrol Officers arrived at 
Conner Park located on the southeast corner of Jewel Lake Road and International Airport Road 
in Anchorage, Alaska. J.K.and D.T. were already present. Attached to the park sign, below a 
flyer for a lost dog named “Albert,” was a ziploc bag which contained a folded piece of paper. 

15. On one side of the piece of paper, there was a photograph of S.K. with silver duct 
tape around her mouth and chin. She appeared to be wearing eye liner, and a light-colored, 
latex-gloved hand and lightly complected, muscular arm was holding S.K.'s hair. In the upper 
part of the photo was an Anchorage Daily Newspaper determined to be the issue released on 
Monday, February 13, 2012. 

16. On the reverse side of the piece of paper was a ransom note which demanded 
$30,000. The note included the 16-digit card number of the debit card belonging to D.T., which 
he had reported stolen on the night of the kidnaping, as summarized above. This debit card 
number is correlated to a bank account number held by D.T. and S.K. The note demanded that 
$30,000.00 be deposited into that account and indicated that the writer of the note intended to 
withdraw money at regular intervals over the coming days, and in locations other than Alaska. 
Specifically, it said, “I may not use the card much in ak due to small pop but as I will be leaving 
soon I will be using it all over.” The note further gave an indication that S.K. had been moved 
from Alaska, stating that “she did almost get away twice, once on tudor and once in the desert. 
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must be losing my touch.” 1 know from research, training, and experience, and discussions with 
law enforcement officers familiar with Alaska that there are no areas in Alaska commonly 
referred to and known to be “deserts,” Many such areas do exist in Arizona, New Mexico and 
Texas. Subsequent analysis of the demand note by the FBI Laboratory revealed that it was typed 
with a typewriter that used a carbon ribbon, and that the aforementioned picture on the back of 
the demand note was printed with an inkjet printer. 

17. On 02-29-2012, at approximately 16:55 AST, J.K. contacted APD Detectives and 
told them he was withdrawing $5,000.00 from the reward account set up for S.K. at Denali 
Alaskan Federal Credit Union, and he intended to deposit it in the ransom fund, which was an 
account held by Credit Union 1. Pursuant to a State search warrant obtained by APD Detective 
Joseph Barth on 02-25-2012, investigators were informed that $5,000.00 was deposited in the 
Credit Union 1 account indicated on the ransom note, (the account attached to the Credit Union 

1 VISA debit card [VISA debit card] bearing XXXXXXXXXXXX2851, expiration 01/15 issued 
to D.T).at 17:45 AST on 02-29-2012). 

Unauthorized use of Credit Union 1 VISA debit card 

18. On 02-29-2012 at 22:13 AST, an unknown person utilizing D.T.’s Credit Union 1 
debit card attempted to withdraw $600.00 in US Currency from the account indicated on the 
ransom note. The attempted withdrawal took place at the Automatic Teller Machine (ATM) 
located at the Alaska USA bank at 4000 Credit Union Drive in Anchorage, Alaska. Because the 
attempted amount was over the $500.00 daily limit, the withdrawal was declined. Surveillance 
video in the area of the ATM revealed a male dressed in a black hooded sweatshirt and black 





pants, operating a light-colored SUV, arrived in the parking lot of the Sea Galley restaurant 
across the street. After parking the SUV, the male exited and quickly walked across the street to 
the area of the Alaska USA ATM. The SUV was later determined by the FBI to be a silver 
Nissan Xterra of a model between the years 2005 and 2012. As noted below, police have now 
determined that KEYES’ girlfriend owns a silver 2007 Nissan Xterra. 

19. On 02-29-2012 at 23:56 AST, $500.00 in US Currency was withdrawn from the 
ATM at the Denali Alaskan Federal Credit Union located at 3020 Minnesota Drive in 
Anchorage, Alaska. The debit card utilized to withdraw the money was the same Credit Union 1 
debit card issued to D.T. Surveillance video obtained of the area revealed this withdrawal was 
conducted by an unknown male with a muscular appearance wearing a dark-colored, possibly 
hooded, jacket with a light-colored design or paint spatter on the left chest and ftont, and light- 
colored lettering, including possibly "CORPS" across the back shoulders; clear or light-colored 
glasses; a gray face mask; gray gloves; dark-colored pants; and light-colored shoes. 

20. During the course of the investigation, Detective Blanton and Officer Pierce of 
APD obtained surveillance footage from businesses surrounding the Alaska USA, which is 
located on Credit Union Drive in Anchorage, Alaska. Immediately before the withdrawal, a 
hidden surveillance camera located at the Sea Galley at 4101 Credit Union Drive in Anchorage, 
Alaska captured a similarly dressed male park in the extreme southwest comer of the Sea Galley 
parking lot driving a silver Nissan Xterra. From the surveillance video, the male appeared to 
exit the vehicle and walk westbound across the street to the Alaska USA and return a short while 
later. Both the male’s appearance and timing are commensurate with him being the person who 
attempted to withdraw the money. 
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21. On 03-01-2012 at approximately 00:28 AST, $500.00 in US currency was 
withdrawn from the ATM at the Alaska USA located at 7701 Debarr Road in Anchorage, 

Alaska. As with the prior two transactions, the debit card utilized to'withdraw the money was 
the Credit Union 1 debit card issued to D.T. 

22. On 03-07-2012 at approximately 21:57 AST, $400.00 in US currency was 
withdrawn from the ATM at the Western Bank located at 200 West Rex Allen Road in Willcox, 
Arizona. The debit card utilized to withdraw the money was the Credit Union 1 debit card 
issued to D.T. Surveillance video on the ATM showed the individual using the debit card for 
the withdrawal was a white male dressed in a gray hooded jacket or sweatshirt, glasses, a gray 
face mask, gray gloves, dark-colored pants, and light-colored shoes, and appeared to be driving a 
late model white Ford Focus sedan. 

23. On 03-07-2012 at approximately 23:24 AST, there was an attempted $400.00 
withdrawal at the Western Bank located at 711 Main Street in Lordsburg, New Mexico, using 
D.T.’s Credit Union 1 debit card (the same card referenced in prior paragraphs.) The withdrawal 
was declined by the ATM as it would have put the debit card over the daily withdrawal limit. 

At 23:25 AST, at the same ATM, a balance inquiry was conducted on the account utilizing the 
debit card. The balance shown was $3,598.91. At 23:26 AST, $80.00 was withdrawn from the 
account utilizing the debit card. Surveillance video on the ATM showed the individual using the 
debit card wore similar clothing to the first ATM withdrawal in Arizona. 

24. On 3-9-2012 at approximately 23:23 AST; there was a $483.00 withdrawal made 
at an ATM at Houston Community Bank, 1515 FM 1960 Bypass East, Humble City, Texas. 
Initial review of the surveillance video from the ATM appeared to show that the individual using 
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the debit card wore similar clothing to that worn during the two aforementioned ATM 
withdrawals in Arizona and New Mexico. 

25. On 03-11-2012 at approximately 23:47 AST, there was a $480.00 withdrawal at 
the People’s State Bank located at 5850 Hwy 59 South, Shepherd, Texas using D.T.’s Credit 
Union 1 debit card (the same card referenced in prior paragraphs.) Surveillance video on the 
ATM showed the individual using the debit card wore similar clothing to the first ATM 
withdrawal in Arizona, as well as the subsequent withdrawals in New Mexico and Texas. 

Ston of the White Ford Focus 

26. On 03/13/2012, at approximately 11:00 Central Time (CT), Texas Ranger Steven 
Rayburn, while in the company of FBI Agent Deborah Gannoway, was notified by Texas 
Department of Public Safety (DPS) Highway Patrol Corporal Bryan Henry (Corporal Henry) that 
a white Ford Focus sedan bearing Texas license plate DH4N930 was observed parked at the 
Quality Inn & Suites (QIS), 4306 South First Street, Lufkin, Texas, which is a short drive from 
Shepherd, Texas. 

27. On 03/13/2012, at approximately 11:15 CT, Ranger Rayburn and FBI Agent 
Deborah Gannoway responded to the QIS, at which time Agent Gannoway conducted a walk-by 
and visual inspection of the white Ford Focus. Agent Gannoway noted a bar-code sticker on the 
driver's side back passenger window consistent with stickers applied to rental vehicles. Agent 
Gannoway also noted numerous items of clothing, trash and other debris in plain sight within the 
vehicle, including what appeared to be a girl's or woman's pink item of clothing. Ranger 
Rayburn caused a Texas license plate database search to be conducted which revealed the white 
2012 Ford Focus was registered to PV Holding Corporation, 9603 John Saunders Road, San 
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Antonio, Texas. DPS Criminal Investigative Division (CID) Lieutenant Mickey Hadnot 
(Lieutenant Hadnot) maintained surveillance on the Ford Focus. 

28. On 03/13/2012, at approximately 11:30 CT, Lieutenant Hadnot reported to 
Ranger Rayburn, who was in the company of FBI Agent Deborah Garmoway, that a white male 
adult exited room 215 of the QIS, placed some items into the trunk of the aforementioned white 
Ford Focus, and departed the scene alone, driving the white Ford Focus. FBI Agent Gannoway 
had previously obtained from the QIS front desk manager an "in house list" of all occupants of 
the QIS on the night of 03/12/2012, which reflected room 215 was rented by ELIJAH KEYES 
for the time period 03/09/2012 through 03/13/2012. 

29. On 03/13/2012, at approximately 11:45 CT, Corporal Henry conducted a traffic 
stop on the white Ford Focus sedan based in part on FBI Agent Gannoway’s suspicion that the 
vehicle was the same vehicle used in the Arizona, New Mexico, and Texas ATM withdrawals, 
as well as Corporal Henry's assessment that the driver of the vehicle was traveling in excess of 
the posted speed limit. Upon FBI Agent Gannoway’s arrival at the car stop location. Corporal 
Henry provided to FBI Agent Gannoway Alaska Driver’s License number 7268639, in the name 
of ISRAEL KEYES, which KEYES had provided to Corporal Henry prior to Agent Gannoway’s 
arrival at the scene. Corporal Henry told Agent Garmoway that KEYES informed him he flew 
from Anchorage, Alaska, to Las Vegas, Nevada, on 03/07/2012, and that he rented the white 
Ford Focus at the Las Vegas airport, driving to his present location over the course of the 
ensuing week. KEYES provided to Agent Gannoway a copy of his car rental agreement, which 
corroborated his statement that he had rented the car at the Las Vegas, Nevada, airport on 
03/07/2012. KEYES was unable to describe to Agent Gannoway the route he drove from 




Nevada to Texas, but stated he was in Lufkin, Texas, to attend his sister's wedding in Weils, 
Texas. KEYES told Agent Gannoway he "probably" paid for fuel throughout his travels from 
Nevada to Texas with cash. Ranger Rayburn reported to Agent Gannoway that there was a pair 
of large white tennis shoes partially pushed under the driver's seat of the Ford Focus, which 
Ranger Rayburn could plainly see through the window. During questioning by Agent Gannoway 
and Ranger Rayburn, KEYES became increasingly agitated and uncooperative, and he refused to 
allow Agent Gannoway and/or Ranger Rayburn to inspect his wallet (which was in his pocket) 
or his vehicle. KEYES became unusually nervous and began to sweat profusely, in spite of the 
slightly cool weather and the tank top which he was wearing at the time. KEYES expressed to 
Agent Gannoway that if he was going to be kept in the area for a longer period of time, he 
desired to call his brother (who has KEYES' daughter in a separate car) and notify him of same. 
Agent Gannoway suggested KEYES make that call. A short time later, the 2012 Ford Focus was 
transported to and secured at the Lufkin, Texas, Police Department. 

30. Based on the aforementioned observations, including the fact that the rented Ford 
Focus matched the description of the vehicle utilized in the ATM withdrawals in Arizona, New 
Mexico and Texas, KEYES' arrival in Las Vegas, Nevada, and his subsequent travel from 
Nevada to Texas very likely resulting in KEYES traveling through Arizona on or about 
03/07/2012 (the date of a $400.00 ATM withdrawal in Arizona) and New Mexico on or about 
03/08/2012 (the date of an $80.00 ATM withdrawal in New Mexico), KEYES' appearance 
closely matching the description of the white male adult observed in videos of the above- 
described ATM withdrawals, KEYES' own admission that he lived in the Anchorage, Alaska, 
area, KEYES’ Alaska driver’s license reflecting an Anchorage, Alaska, address, the white tennis 




shoes under the driver's seat matching the description of the shoes worn by the white male adult 
observed in the videos of the above-described ATM, as well as other observations, Agent 
Gannoway instructed Corporal Henry to place KEYES under arrest. Ranger Rayburn, in Agent 
Gannoway’s presence, searched KEYES’ wallet, revealing a VISA ATM/Debit card bearing 
account number XXXXXXXXXXXX2851, expiration’date 01/15, in the name of D.T. This 
card is linked to the “ransom account” identified above, from which the withdrawals and 
attempted withdrawals summarized above were made. 

Discovery of KEYES’ White Chevrolet Truck 

31. APD Detectives discovered that ISRAEL KEYES listed a mailing address of 
3705 Arctic Blvd. #2891 in Anchorage, Alaska, on 07-18-2011, which is the Mail Cache. APD 
Detectives also discovered that KEYES listed a residential address of 2456 Spurr Lane in 
Anchorage, Alaska, as of 07-18-2011. 

32. On 03-13-2012 at approximately 10:30 AST, members of the APD Special 
Assignment Unit went to KEYES’ home address at 2456 Spurr Lane in Anchorage, Alaska. No 
one answered repeated knocks on the door. Per APD Sergeant Redick, there were fresh tire 
impressions in the snow in the driveway of the address that appeared as if a vehicle had been 
parked there as recently as the morning of 03-13-2012. 

33. There was also a white Chevrolet pickup truck parked in the driveway of the 
address. The truck had a large toolbox in the bed and a ladder rack on top. The bolts securing 
those items were removable and appeared to have been recently added. The license plate on the 
truck was Alaska license plate FTC990, relating to a white 2004 Chevrolet Silverado, registered 
to ISRAEL KEYES at 2456 Spurr Lane in Anchorage, Alaska. The white Chevrolet truck 
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appeared to match the vehicle appearing in the Home Depot surveillance video, as summarized 
above. Further, Detectives eventually contacted KEYES’ girlfriend and discovered that she 
drives a 2007 Nissan Xterra, which matched the general description of the vehicle used by an 
individual who appeared to attempt to use the stolen debit card on 2-29-12, as summarized 
above. 

Discovery OF KEYES’ Computer Use and Use of Yahoo Account 

34. KEYES' girlfriend, who also lives at his residence, was interviewed on 
approximately March 14,2012. She indicated KEYES was out of Alaska. She also indicated 
that KEYES owned a laptop computer and that his computer was not in the residence. 

35. Alaska Airlines provided travel records for KEYES pursuant to a Federal Grand 
Jury Subpoena that was, issued Jo them on March 14, 2012. In reviewing the returns for this 
subpoena, travel records were found showing KEYES and his young daughter traveled to 
Houston on February 2;.:2012'."'KEYES was originally scheduled to return on February 14,2012 
but changed the ticket to return on February 17,2012. The ticket was booked online October 1, 
2011 and an email confirmation was sent on the same date. The return ticket was changed to 
February 17,2012 and an email confirmation was sent on 2/15/2012. The notes for this 
transaction indicate the email confirmation was sent to an email address believed to belong to 
A.K., the mother of KEYES’ daughter. However, the tickets were booked using A.K.’s credit 
card. A.K.does not reside in the state of Alaska and it is likely she had to forward the email 
confirmation to KEYES so that he would know the dates/times of travel. 

36. In reviewing the returns for this subpoena, travel records were also found 
showing KEYES and his young daughter traveled to Las Vegas on March 6,2012 via Alaska 





Airlines. This ticket was booked online and he provided an email address with the 
reservation. The notes section of the travel records indicated the email address provided was 
israelkeves@vahoo.com . The records also indicated an email confirmation was sent to 
israelkeves@vahoo.com on March 1,2012. 

Execution of Search Warrant on Ford Focus and Discovery of Laptop Computer 

37. On March 16,2012, law enforcement agents in Beaumont, Texas obtained a 
search warrant, which authorized the search of the white Ford Focus driven by KEYES. 
Execution of that search warrant on March 17,2012 revealed numerous items, including a 
cellular phone believed to belong to S.K. and a Lenovo B570 laptop, black in color. Model 
#1068, S/N WB03686639. 

38. In my training and experience, I know that photos fiom digital cameras and 
cellular phones are frequently downloaded to computers and electronic tablets, and then printed 
or stored on media devices. I also know that cellular phones, computers, electronic tablets and 
similar devices are frequently used to arrange travel and hotel reservations, rent vehicles, and 
conduct other personal business related to traveling. I also know that computers and cellular 
phones can be used to connect to the internet, which can be used to locate banks, ATM’s, hotels, 
maps, send email, draft documents, and communicate with others. I also know that storage 
devices for electronic information, or “thumb” drives,.are often used to store such information 
for later use by computers, cellular phones and other media devices. I know that electronic 
records of all such uses of computers and similar elebfrpnic devices are retained within those 
devices and may be retrieved by forensic techniifiadf,;.. ■ 







39. The Device is currently in the lawful possession of the FBI. The Device came 
into the FBI’s possession as outlined above. Although the FBI might already have the lawful 
authority to examine the Device, I seek this additional warrant out of an abundance of caution to 
be certain that an examination of the Device will comply with the Fourth Amendment and other 
applicable laws. 

40. The Device is currently in storage at FBI Anchorage District, Anchorage, Alaska. 
In my training and experience, I know that the Device has been stored in a manner in which its . 
contents are, to the extent material to this investigation, in substantially the same state as they 
were when the Device first came into the possession of the FBI. 

TECHNICAL TERMS 

41. Based on my training, my experience, and information provided to me by other 
law enforcement personnel, I use the following technical terms to convey the following 
meanings: 


a. “Storage medium”: A storage medium is any physical object upon 
which computer data can be stored. Examples include a laptop 
computer’s internal hard disk drive. 

b. “Computer”: Pursuant to 18 U.S.C. § 1030(e)(1), a computer is 
“an electronic, magnetic, optical, electrochemical, or other high 
speed data processing device performing logical or storage 
functions, and includes any data storage facility or 
communications facility directly related to or operating in 
conjunction with such device.” 

c. IP Address: An Internet Protocol address (or simply “IP Address”) 
is a unique numeric address used by computers on the Internet. 

An IP address is a series of four numbers, each in the range 0-255, 
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separated by periods (e.g., 121.56.97.178). Every computer 
attached to the Internet must be assigned an IP address so that 
Internet traffic sent from and directed to that compuiter may be 
directed properly from its source to its destination. Most Internet 
service providers control a range of IP addresses'. Some computers 
have static- that is, long-term - IP addresses, while other 
computers have dynamic - that is, frequently changed - IP 
addresses. 

d. Internet: The Internet is a global network of computers and other 
electronic devices that communicate with each other. Due to the 
structure of the internet, connections between devices on the • 
internet often cross state and international borders, even when the 
devices communicating with each other are in the same state. 

COMPUTERS, ELECTRONIC STORAGE, AND FORENSIC ANALYSIS 

42. The applied-for warrant would authorize the forensic imaging and examination of 
the Target Device for the purpose of identifying and seizing the electronically stored information 
particularly described in Attachment B in accordance with Federal Criminal Procedure Rule 
41(e)(2)(B) (“Warrant Seeking Electronically Stored Information”). 

43. Probable Cause : Based on my training, experience, and information related to me 
by agents and others involved in the forensic examination of computers, I submit there is 
probable cause to believe that information that was once stored on the Target Device may still be 
stored there, for at least the following reasons: 

a. Based on my knowledge, training, and experience, I know that 
computer files or remnants of such files can be recovered days, 
months or even years after they have been stored on a storage 
medium (e.g., laptop computer’s hard drive). Even when files 
have been deleted, they can be recovered using forensic tools. 

This is so because when a person “deletes” a file on a computer, 
the data contained in the file does not actually disappear; rather. 
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that, data remains on the storage medium until it is overwritten by 
new data. 

b. Therefore, deleted files, or remnants of deleted files, may reside in 
free space or slack space - that is, in space on the storage medium 
that is not currently being used by an active file - for long periods 
of time before they are overwritten. In addition, a computer's 
operating system may also keepi a record of deleted data in a 
“swap” or “recovery” file. 

c. Wholly apart from user-generated files, computer storage media - 
in particular, a laptop computer’s internal hard drive - contain 
electronic evidence of how a computer has been used, what it has 
been used for, and who has used it. To give a few examples, this 
forensic evidence can take the form of operating system 
configurations, artifacts from operating system or application 
operation, file system data structures, and virtual memory “swap” 
or paging files. Computer users typically do not erase or delete 
this evidence, because special software is typically required for 
that task. However, it is technically possible to delete this 
information. 

d. Similarly, files that have been viewed via the Internet are 
sometimes automatically downloaded into a temporary Internet 
directory or “cache”. Things that have been viewed via the 
internet are typically stored for some period of time on the device. 
This information can sometimes be recovered with forensics tools. 

e. Based on my knowledge, training, and experience, I know that 
computer files or remnants of such files can be recovered months 
or even years after they have been downloaded onto a storage 
medium, deleted, or viewed via the Internet. Electronic files 
downloaded to a storage medium can be stored for years at little or 
no cost. Even when files have been deleted, they can be recovered 
months or years later using forensic tools. This is so because 

• when a person “deletes” a file on a computer, the data contained in 
the file does not actually disappear; rather, that data remains on the 
storage medium until it is overwritten by new data. 

f. Therefore, deleted files, or remnants of deleted files, may reside in 
free space or slack space—that is, in space on the storage medium 
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that is not currently being used by an active file—for long periods . 
of time before they are overwritten. In addition, a computer’s 
operating system may also keep a record of deleted data in a 
“swap” or “recovery” file. ' 

g. Wholly apart from user-generated files, computer storage 

media—in particular, computers’ internal hard drives—contain 
electronic evidence of how a computer has been used, what it has 
been used for, and who has used it. To give a few examples, this 
forensic evidence can take the form of operating system 
configurations, artifacts from'operating system or application 
operation, file system data structures, and virtual memory “swap” 
or paging files. Computer users typically do not erase or delete 
this evidence, because special software is typically required for 
that task. However, it is technically possible to delete this 
information. 

44. Based on my training, experience, and research, I know that the Device has 
capabilities that allow it to serve as a portable media player, internet browser, and digital camera 
and photoshop, amongst other capabilities. 


45. Forensic evidence'. As further described in Attachment B, this application seeks 
permission to locate not only electronically stored information that might serve as direct evidence 
of the crimes described on the warrant, but also forensic evidence that establishes how the Target 
Device was used, the purpose of its use, who used it, and when. There is probable cause to 
believe that this forensic electronic evidence more likely than not is stored in the Target Device 
because: 


Data on a storage medium can provide evidence of a file that was 
once on the storage medium but has since been deleted or edited, 
or of a deleted portion of a file (such as a paragraph that has been 
deleted from a word processing file). Virtual memory paging 
systems can leave traces of information on the storage medium that 
show what tasks and processes were recently active. Web browser, 
chat and email programs store configuration information on the 
storage medium that can reveal information such as online 





passwords and aliases. Operating systems can record additional 
information, such as the attachment of peripherals, the attachment 
of USB flash storage devices or other external storage media, and 
the times the computer was in use. Computer file systems can 
record information about the dates files were created and the 
sequence in which they were created. 

b. Forensic evidence stored within the Target Device can also indicate 
who has used or controlled the Target Device. This “user 
attribution” evidence is analogous to the search for “indicia of 
occupancy” while executing a search warrant at a residence. 

c. A person with appropriate familiarity with how the Target Device 
works may, after examining this forensic evidence in its proper 
context, be able to draw conclusions about how electronic devices 
were used, the purpose of their use, who used them, and when. 

d. The process of identifying the exact electronically stored 
information on a storage medium that are necessary to draw an 
accurate conclusion is a dynamic process. Electronic evidence is 
not always data that can be merely reviewed by a review team and 
passed along to investigators. Whether data stored on a computer 
is evidence may depend on other information stored on the 
computer and the application of knowledge about how a computer 
behaves. Therefore, contextual information necessary to 
understand other evidence also falls within the scope of the 
warrant. 

e. Further, in finding evidence of how the Target Device was used, 
the purpose of its use, who used it, and when, sometimes it is 
necessary to establish that a particular thing is not present on a 
storage medium. 

46. Nature of examination-. Based on the foregoing, and consistent with Rule 
41(e)(2)(B), the warrant I am applying for would permit the examination of the Target Device 
consistent with the warrant. The examination may require authorities to employ techniques, 
including but not limited to computer-assisted scans of the Target Device’s entire storage 
medium, that might expose many parts of the device to human inspection in order to determine 
whether it is evidence described by the warrant. 
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47. Manner of execution : Because this warrant seeks only permission to examine a 
laptop computer already in law enforcement’s possession, the execution of this warrant does not 
involve the physical intrusion onto a premises. Consequently, I submit there is reasonable cause 
for the Court to authorize execution of the warrant at any time in the day or night. 

48. Forensic image retention : I hereby request judicial authorization to retain foil 
image copies of seized storage media after the review is complete (to the extent that this warrant 
does not already authorize me to retain that storage media as seized forfeitable property) and until 
further order of the Court. That judicial authorization is justified in this case in part because: 


a. Should the execution of the warrant uncover data that may later 
need to be introduced into evidence during a trial or other 
proceeding, the authenticity and the integrity of the evidence and 
the government's forensic methodology may be contested issues. 
Retaining copies of seized storage media can be required to prove 
these facts. 

b. Returning the original storage medium to its owner will not allow 
for the preservation of that evidence. Even routine use may forever 
change the data it contains, alter system access times, or eliminate 
data stored on it. 

c. Because the investigation is not yet complete, it is not possible to 
predict all possible defendants against whom evidence found on 
the storage medium might be used. That evidence might be used 
against persons who have no possessory interest in the storage 
media, or against persons yet unknown. Those defendants might 
be entitled to a copy of the complete storage media in discovery. 
Retention of a complete image assures that it will be available to 
all parties, including those known now and those later identified. 

d. The act of destroying or returning a storage medium could create 
an opportunity for a defendant to claim, falsely, that the destroyed 
or returned storage medium contained evidence favorable to him. 
Maintaining a copy of the storage medium would permit the 
government, through an additional warrant if necessary, to 
investigate such a claim. 




e. Similarly, should a defendant suggest an explanation for the 

presence of evidence on a storage medium, it may be necessary to 
investigate such an explanation by, among other things, 
re-examining the storage medium with that defense in mind. This 
may require an additional examination of the storage medium for 
evidence that is described in Attachment B but was not properly 
identified and segregated previously. 

CONCLUSION 


49. Based on my training and experience, and the facts as set forth in this affidavit, 
there is probable cause to believe that on the Lenovo B570 laptop, black in color, Model #1068, 
S/N WB03686639 there exists fruits, evidence, and instrumentalities of violations of Title 18, 
United States Code (USC), Section 1029(a)(5) (Fraud and Related Activity in Connection with 
Access Devices )(FRACAD); Title 18, United States Code, Section 1201 (Kidnapping); and Title 
18, United States Code, Section 1202(b) (Ransom Money). 

50. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. 18 U.S.C. §§ 2703(a), (b)(1)(A) & 
(c)(1)(A). Specifically, the Court is “a district court of the United States ... that - has 
jurisdiction over the offense being investigated.” 18 U.S.C. § 2711(3)(A)(I). 

REQUEST FOR SEALING 

51. The investigation of this case is ongoing and disclosure of the issuance of the 
search warrant could result in destruction of evidence and could also impact officer, witness and 
victim safety. Accordingly, pursuant to the case law outlined in the government’s motion to seal, 


IN THE MATTER OF THE SEARCH OF Lenovo B570 laptop, black in color. Model #1068, 
S/N WB03686639, CURRENTLY LOCATED AT FBI ANCHORAGE NON-DRUG 
EVIDENCE LOCKER 
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I respectfully request that the search warrant, search warrant affidavit, attachments, and returns 
be sealed. 

PURPOSE OF AMENDED SEARCH WARRANT 

52. The original affidavit in support of this search warrant contained a series of 
attribution errors. Due to a scrivener's error, the original affidavit referred in numerous locations 
to “the affiant” or “your affiant,” as observing or taking actions in the first person, when in fact 
these observations were made and actions taken not by your affiant, but rather by FBI Special 
Agent Deborah Gannoway. This error was inadvertent, and at the time the original affidavit was 
executed, your affiant was fully aware and cognizant of all the facts asserted therein. Those 
substantive facts remain unchanged in this amended affidavit. Rather than personally observing 
or partaking in these facts, however, your affiant knew of them through information provided by 
other law enforcement personnel (including FBI Special Agent Gannoway), through research and 
through review of law enforcement reports. This affidavit reflects accurately the instances in 
which FBI Special Agent Gannoway (amongst other law enforcement officers) was physically 

/ 

/ 

/ 

/ 

IN THE MATTER OF THE SEARCH OF Lenovo B570 laptop, black in color. Model #1068, 
S/N WB03686639, CURRENTLY LOCATED AT FBI ANCHORAGE NON-DRUG 
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present during events. 


F ur tw*r— a-PC'".* -^ naught 

^ /s/ Signature Redacted 

Special Agent Jolene Goeden 
Federal Bureau of Investigation 


SUBSCRIBED and SWORN to before me 




is 2Z- day^’f iDevi-X , 2 


: >f ; ^/s/JohnD.. Roberts, USKio ^ 

**'-^Signature Radgcted _ 



IN THE MATTER OF THE SEARCH OF Lenovo B570 laptop, black in color, Model #1068, 
S/N WB03686639, CURRENTLY LOCATED AT FBI ANCHORAGE NON-DRUG 
EVIDENCE LOCKER 
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< ^AO r ~93 (Rev. 12/03) Search Warrant 


United States District Court 

_ District of _ Alaska _ 

In the Matter of the Search of 

(Name, address or brief description of person or properly to be searched) 

SEARCH WARRANT 

Black LG Cellular Telephone, S/N 104CYHE2202705 


Case Number: 3:12-mj-000136-JDR 


TO: _ S/A Jolene Goeden, FBI _and any Authorized Officer of the United States 

Affidavit(s) having been made before me by _ S/A Jolene Goeden, FBI _who has reason to believe 

Affiant 

that nO on the person of, or 0Qon the premises known as (name, description and/or location) 

See Attachment A, which is incorporated by reference, 


in the _District of_ Aiaska _there is now 

concealed a certain person or property, namely (describe the person or property) 

See Attachment B, which is incorporated by reference. 


I am satisfied that the affidavit(s) and any record testimony establish probable cause to believe that the person or property so described 
is now concealed on the person or premises above-described and establish grounds for the issuance of this warrant. 


YOU ARE HEREBY COMMANDED to search on or before 


4/1/2012 

Date 


(not to exceed 10 days) the person or place named above for the person or property specified, serving this warrant and making the 
search [2 in the daytime — 6:00 AM to 10:00 P.lyf. □ at anytime in the day or night as I find reasonable cause has been 
established and if the person or property be found there to seize same, leaving a copy of this warrant and receipt for the person 
or property taken, and prepare a written inventory of the person or property seized and promptly return this warrant to 
__ as required by law. 

U.S^MagistrateJudge (Rule 4 1 (f)(4)) 


WtoA yin'll at 

and Time issued .PM 

JOHN D. ROBERTS 

U.S. MAGISTRATE JUDGE 






^ N/s/John D. Roberts, USMJ 
__Signature Redacted 

Signature -- ■ ■ ■ ,, 





















ATTACHMENT A 


The property to be searched is an LG cellular telephone, black in color, S/N 
104CYHE2202705, currently located at non-drug evidence locker at FBI Anchorage, 101 East 6 th 
Avenue, Anchorage, Alaska 99501. _ 




ATTACHMENT B 


All records and information on the Target Device identified in Attachment A that relate to 
violations of Title 18, United States Code (USC), Section 1029(a)(5) (Fraud and Related Activity 
in Connection with Access Devices )(FRACAD); Title 18, United States Code, Section 1201 
(Kidnapping); and Title 18, United States Code, Section 1202(b) (Ransom Money), and involve 
ISRAEL KEYES, including: 


1. Evidence of who used, owned, or controlled the Target Device and evidence of 
the Target Device contacting or communicating with other cellular phones or 
electronic devices, including text messages, application data, calender entries, 
notes, call records, contact or address book entries, photos, location information, 
and Internet browser history/cache. 

2. Evidence of the times the Target Device was used. 

3. The substantive content of any text communications to or from the Target Device. 

4. Contextual information necessary to understand the evidence described in this 
attachment. 

As used above, the terms “records” and “information” include all of the foregoing items 
of evidence in whatever form and by whatever means they may have been created or stored, 
including any form of computer or electronic storage. 




United States District Court 

for the 

District of Alaska 


In the Matter of the Search of ) 

(Briefly describe the property to be searched ) 

or identify the person by name and address) j 

Biack LG Cellular Telephone, S/N 104CYHE2202705 ) 

) 


Case No. 3:12-mj-000136-JDR 


APPLICATION FORA SEARCH WARRANT 

L a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or descrtbe the 

herein by reference 


■ located in the _ District of_ Alaska , there is now concealed (identify the 

person or describe the property to be seized): 

See Attachment B, which is incorporated herein by reference 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
gf evidence of a crime; 

O contraband, fruits of crime, or other items illegally possessed; 

Sf property designed for use, intended for use, or used in committing a crime; 
□ a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 

Code Section °ff ense Description 

18 U.S.C. 1029(a)(5) Access Device Fraud 

18U.S.C. 1201 Kidnapping 

18 U.S.C. 1202(b) Ransom Money 


The application is based on these facts: 

See Attached Affidavit, which is incorporated 


herein by reference 


fif Continued on the attached Sheet. 

O Delayed notice of_days (give exact ending date if more than 30 days:_) is requested 

under 18 U.S.C. § 3103a, the basis of which is set forth on t’ 

/s/ Signature Redacted 

=s ’ Applicant's signature 


Sworn to before me and signed in my presence. 
Date: 03/22/2012 


_ Jolene Goeden, FBI Special Agent 

-. ,Printednapie. (md title 

, 5 ^ —•* * 

/-Ife/John D. Roberts, USNU 

-il^C^Signature Redacted ^ j_ - 

judge'sSignature - . 





ATTACHMENT A 

The property to be searched is an LG cellular telephone, black in color, S/N 
104CYHE2202705, currently located at non-drug evidence locker at FBI Anchorage, 101 East 6 
Avenue, Anchorage, Alaska 99501. 




' attachment b 


All records and information on the Target Device identified m Attachment A that relate to 
violations of Title 18, United States Code (USC), Section 1029(a)(5) (Fraud and Related Activity 
■in-Cekeetion with Access Devices )(FRACAD); Title 18, United States Code, Section 1201 
(Kidnapping); and Title 18, United States Code, Section 1202(b) (Ransom Money), and involv 
ISRAEL KEYES, including: 


1. Evidence of who used, owned, or controlled the Target Device and evidence of 

the Target Device contacting or communicating with other cellular phones or 
electronic devices, including text messages, application data, calender entries, 
notes, call records, contact or address book entries, photos, location information, 
and Internet browser history/cache. 


2. Evidence of the times the Target Device was used. 

3. The substantive content of any text communications to or from the Target Device. 

4. Contextual information necessary to understand the evidence described in this 
attachment. 


. As used above, the terms “records” and “infon 
of evidence in whatever form and by whatever means 
including any form of computer or electronic storage. 


mation” include all 


of the foregoing items 


they may have been created or stored, 
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UNITED STATES DISTRICT COURT 
THE DISTRICT OF ALASKA 


) 

IN THE MATTER OF THE SEARCH OF ) Case No. 3:12-mj-00136-JDR 

) 

BLACK LG CELLULAR TELEPHONE ) 

S/N104CYHE2202705 ) 

) 

) 

) 

) 

_ ) 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 

I, Jolene Goeden, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 

1. I am a Special Agent of the Federal Bureau of Investigation (FBI). I have been a 
Special Agent of the FBI since April 2004. I am charged with the duty of investigating violations 
of the laws of the United States, collecting evidence in cases in which the United States is or may 
be a.party in interest, and performing other duties imposed by law. I have been assigned to 
investigate most criminal matters within the jurisdiction of the FBI, including kidnapping 
matters, fraud matters and other white collar crime. 

2. I make this affidavit in support of an application under Rule 41 of the Federal Rules of 
Criminal Procedure for a warrant to search five electronic items seized during a common set of 
searches and pursuant to a common set of circumstances, as outlined below : 

a) BLACK LG CELLULAR TELEPHONE, s/n 104CYHE2202705, ftirther 
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identified in Attachment A, for the information identified in Attachment B. 

This item is currently located at FBI Anchorage at 101 East Sixth Avenue, Anchorage, 
Alaska, in the secure, non-drug evidence vault. 

3. As set forth herein, there is probable cause to believe that in the property to be searched 
there exists evidence of a crime, contraband, fruits of a crimes, or other items illegally possessed 
in violation of Title 18, United States Code (USC), Section 1029(a)(5) (Fraud and Related 
Activity in Connection with Access Devices )(FRACAD); Title 18, United States Code, Section 
1201 (Kidnapping); and Title 18, United States Code, Section 1202(b) (Ransom Money), as 
further described in Attachment A. 


RELEVANT STATUTES 

4. The Target Device contains evidence of and is an instrumentality used for 
violations of Title 18, USC, Section 1029(a)(5), Fraud and Related Activity in Connection with 
Access Devices, which provides that: 

Whoever, knowingly and with intent to defraud effects transactions with 1 or more access 
devices issued to another person or persons, to receive payment or any other things of 
value during any 1-year period that aggregate value of which is equal to or greater than 
$ 1 , 000 ; 

and Title 18, United States Code, Section 1201 (Kidnaping), which provides that: 

Whoever unlawfully seizes, confines, inveigles, decoys, kidnaps, abducts, or carries away 
and holds for ransom or reward or otherwise any person, except in the case of a minor by 
the parent thereof, when the person is willfully transported in interstate or foreign 
commerce, regardless of whether the person was alive when transported m interstate or 
foreign commerce or uses the mail or any means, facility, or instrumentality of interstate 
or foreign commerce in committing or in furtherance of the commission of the offense; 

and Title 18, United States Code, Section 1202(b) (Ransom Money), which provides that:. 

Whoever receives, possesses, or disposes of any money or other property, or any portion 




thereof, which has at any time been delivered as ransom or reward in connection with a 
violation of section 1201 of this title, knowing the same to be money or property which 
has been at any time delivered as such ransom or reward. 

6. The applied for warrant would authorize the forensic examination of the devices listed 
above in paragraph 2, and further identified in Attachment A, for the purpose of identifying 
electronically stored data particularly described in Attachment B. 

PROBABLE CAUSE 

7. The information contained below is from my personal knowledge and experience, 
information provided to me by other law enforcement personnel, or from those specific sources 
as set forth. Since this affidavit is being submitted for the limited purpose of seeking 
authorization to search the Devices listed in paragraph 2 above, I have not included each and 
every fact known to me regarding this investigation. I have set forth only the facts that I believe 
are necessary to establish a foundation to support the aforementioned request for a search 
warrant. 

Abduction of S.K. 

8. On 2-2-12 at about 12:39 Alaska Standard Time (AST), Duncan, the owner of the 
Common Ground Coffee stand at 630 E. Tudor, Anchorage, Alaska, contacted APD dispatch. 
Duncan was calling from Oregon, where he was vacationing, He reported that while viewing his 
internet-based security system he saw one of his employees, 18-year-old S.K., appear to be 
abducted. Duncan said he was contacted by S.K.’s father (J.K..) and boyfriend (D.T.), who had 
been unable to locate her. This contact prompted Duncan to review his security video which 
showed an unknown man climb through the window of the coffee stand at about 20:00 AST on 
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2-1-12 while S.K. was working. The video appears to show S.K. retreating a short distance and 
raising her hands in an apparent sign of submission to the man who subsequently climbed into 
the coffee stand, robbed S.K. and escorted her away from the scene. The abductor climbed 
through the window into the coffee stand without any significant difficulty. He appeared to be 
significantly taller than S.K., who is 5'4" tall, but due to the limited lighting and quality of the 
video, a more accurate estimate of his height has not been made. The robber/abductor appeared 
to have a medium to large build and athletic movements. 

9. At the time of her abduction, S.K. was wearing a dark-colored jacket, a green 
shirt with light-colored stripes on the sleeves, a thin dark-colored bracelet, dark-colored pants, 
and dark-colored shoes. At the time of her abduction, S.K. was also believed to be in possession 
of a carabineer with three keys and possibly a white lanyard, a medium-to-Iarge size leopard 
print purse, and a black cellular telephone with sliding keyboard. S.K. is a white female adult, 
approximately 5'4" tall, 150 pounds, 18 years old, with shoulder-length brown hair and brown 
eyes. 

10. Video surveillance appeared to show S.K.'s robber/abductor wearing a dark- 
colored, possibly hooded, jacket, dark-colored glasses, a dark-colored face mask, dark-colored 
gloves, dark-colored pants; and dark-colored shoes. He appeared to be carrying a white coffee 
cup and a dark-colored bag. Although to date no weapon has been conclusively identified in the 
surveillance videos that captured this robbery/abduction, the scene was generally poorly lit and 
the robber/abductor was not always fully visible. Furthermore', '3 K.lotion appeared to be 
consistent with someone who was confronted or threatened With a vs^ppn. In addition, during 
separate subsequent interviews, both S.K.'s father and boyfriend adamantly indicated that S.K. 




was very strong-willed and would not have complied with a robber or abductor's demands, 
unless she had been threatened with a weapon. 

11. Surveillance video from a nearby Home Depot at approximately 19:54 AST on 2- 
1-12 showed a white Chevrolet extended cab truck roil through the Home Depot parking lot and 
park just east of an International House of Pancakes. From a distance, the surveillance showed 
an individual with a black garment and hat get out of the truck and walk westbound through the 
parking lot towards Denali St., cross it, get on the sidewalk, walk southbound on Denali St. to 
Tudor Rd., cross Tudor Rd. at the intersection, and, finally, exit the frame. The individual’s 
travel was in the direction of the Common Ground Coffee stand, from which S.K. was abducted. 
One minute later, the video surveillance footage from Common Ground Coffee stand showed the 
individual who abducted S.K. approach from the direction of the man in the Home Depot video. 
Approximately two minutes after S.K. and her abductor exited the frame of the Common 
Ground Coffee stand video footage, two persons appearing to match S.K. and her abductor again 
entered the frame of the Home Depot video footage, this time walking back towards the location 
where the white Chevrolet truck was originally parked. The Home Depot video then showed the 
two people approach the passenger side door of the Chevrolet truck. It then showed the person 
who appeared to be S.K. enter the passenger side of truck. The other individual then walked 
around truck, entered the driver’s side, and drove out of the surveillance video’s frame. As 
described below, police have now identified KEYES’ residence and located a white Chevrolet 
truck registered to him at that residence. This white Chevrolet truck belonging to KEYES 
appears to match the vehicle in the Home Depot surveillance footage, although KEYES’ truck 
has several toolboxes and a ladder rack fastened with removable bolts to the truck bed, and these 






items do not appear on the truck in the Home Depot video. 

12. During an interview on 02-02-2012, D.T. (S.K.’s boyfriend) said he went to the 
coffee stand on 2-1-12 at about 20:33 AST to give her a ride home but the stand appeared to be 
closed and she was not there. D.T. further reported to law enforcement that on 02/02/2012, at 
approximately 03:00 AST, he observed an unknown male adult wearing a ski mask and dark 
clothing going through the vehicle he shared with S.K, D.T. did not alert authorities to the 
burglary of the vehicle at that time: 

13. When D.T. was asked where his ATM debit card was by APD Detectives several 
days after the abduction, he indicated he had left it in the vehicle he shared with S.K. This 
vehicle had been seized by APD on 02-02-2012 and searched pursuant to a State of Alaska 
search warrant. The debit card referenced above was not located during the search; however law 
enforcement did not notify D.T. of this fact. D.T. indicated that his debit card was a Credit 
Union 1 VISA debit card (VISA debit card) bearing XXXXXXXXXXXX2851, expiration 
01/15, and that he did not give his VISA debit card to anyone else or give anyone permission to 
use it. The card is thus believed to have been stolen from D.T.'s vehicle at the time D.T. 
observed the vehicle break-in. D.T. further related that S.K.’s driver’s license had also been in 
his vehicle. That driver’s license was missing when searched for.on 02-02-2012, indicating that 
it also was stolen at that time. I know that a driver’s license is generally necessary to leave the 
State of Alaska by airplane, road or ferry, due to established interstate (or international in the 
case of travel to/from Alaska via the Alaska-Canada Highway) travel requirements. 
Furthermore, due to Alaska’s unique geographic location, the difficulty of traveling by road 
through northern Canada in winter, and the lengthy periods generally associated with traveling 




to/from Alaska by ferry, commercial airlines are the most common and popular mode of 
interstate travel to/from Alaska, especially during the winter. 

Ransom Note and Transfer of Funds to “Ransom Account” 

14. On 02-24-2012, at 19:56 AST, D.T. received the following text on his cell phone 
907-231-9835 from S.K.’s cell phone 907-884-8370 - “Conner park sign under pic of albert aint 
she purty”. J.K. (S.K.’s father) contacted law enforcement officers and relayed the information. 
At the request of APD Detectives, at approximately 20:18 AST, APD Patrol Officers arrived at 
Conner Park located on the southeast comer of Jewel Lake Road and International Airport Road 
in Anchorage, Alaska. J.K.and D.T. were already present. Attached to the park sign, below a 
flyer for a lost dog named “Albert,” was a ziploc bag which contained a folded piece of paper. 

15. On one side of the piece of paper, there was a photograph of S.K. with silver duct 
tape around her mouth and chin. She appeared to be wearing eye liner, and a light-colored, 
latex-gloved hand and lightly complected, muscular arm was holding S.K.'s hair. In the upper 
part of the photo was an Anchorage Daily Newspaper determined to be the issue released on 
Monday, February 13,2012. 

16. On the reverse side of the piece of paper was a ransom note which demanded 
$30,000. The note included the 16-digit card number of the debit card belonging to D.T., which 
he had reported stolen on the night of the kidnaping, as summarized above. This debit card 
number is correlated to a bank account number held by D.T. and S.K. The note demanded that 
$30,000.00 be deposited into that account and indicated that the writer of the note intended to 
withdraw money at regular intervals over the coming days, and in locations other than Alaska. 
Specifically, it said, “I may not use the card much in ak due to small pop but as I will be leaving 
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soon I will be using it all over.” The note further gave an indication that S.K. had been moved 
from Alaska, stating that “she did almost get away twice, once on tudor and once in the desert, 
must be losing my touch.” I know from research, training, and experience, and discussions with 
law enforcement officers familiar with Alaska that there are no areas in Alaska commonly 
referred to and known to be “deserts.” Many such areas do exist in Arizona, New Mexico and 
Texas. Subsequent analysis of the demand note by the FBI Laboratory revealed that it was typed 
with a typewriter that used a carbon ribbon, and that the aforementioned picture on the back of 
the demand note was printed with an inkjet printer. 

17. On 02-29-2012, at approximately 16:55 AST, J.K. contacted APD Detectives and 
told them he was withdrawing $5,000.00 from the reward account set up for S.K, at Denali 
Alaskan Federal Credit Union, and he intended to deposit it in the ransom fund, which was an 
account held by Credit Union 1. Pursuant to a State search warrant obtained by APD Detective 
Joseph Barth on 02-25-2012, investigators were informed that $5,000.00 was deposited in the 
Credit Union 1 account indicated on the ransom note, (the account attached to the Credit Union 

1 VISA debit card [VISA debit card] bearing XXXXXXXXXXXX2851, expiration 01/15 issued 
to D.T).at 17:45 AST on 02-29-2012). 

Unauthorized use of Credit Union 1 VISA debit card 

18. On 02-29-2012at 22:13 AST, an unknown person utilizing D.T.’s Credit Union 1 
debit card attempted to withdraw $600.00 in US Currency from the account indicated on the 
ransom note. The attempted withdrawal took place at the Automatic Teller Machine (ATM) 
located at the Alaska USA bank at 4000 Credit Union Drive in Anchorage, Alaska. Because the 
attempted amount was over the $500.00 daily limit, the withdrawal was declined. Surveillance 





video in the area of the ATM revealed a male dressed in a black hooded sweatshirt and black 
pants, operating a light-colored SUV, arrived in the parking lot of the Sea Galley restaurant 
across the street. After parking the SUV, the male exited and quickly walked across the street to 
the area of the Alaska USA ATM. The SUV was later determined by the FBI to be a silver 
Nissan Xterra of a model between the years 2005 and 2012. As noted below, police have now 
determined that KEYES' girlfriend owns a silver 2007 Nissan Xterra. 

19. On 02-29-2012 at 23:56 AST, $500.00 in US Currency was withdrawn from the 
ATM at the Denali Alaskan Federal Credit Union located at 3020 Minnesota Drive in 
Anchorage, Alaska. The debit card utilized to withdraw the money was the same Credit Union 1 
debit card issued to D.T. Surveillance video obtained of the area revealed this withdrawal was 
conducted by an unknown male with a muscular appearance wearing a dark-colored, possibly 
hooded, jacket with a light-colored design or paint spatter on the left chest and front, and light- 
colored lettering, including possibly "CORPS" across the back shoulders; clear or light-colored 
glasses; a gray face mask; gray gloves; dark-colored pants; and light-colored shoes. 

20. During the course of the investigation, Detective Blanton and Officer Pierce of 
APD obtained surveillance footage from businesses surrounding the Alaska USA, which is 
located on Credit Union Drive in Anchorage, Alaska. Immediately before the withdrawal, a 
hidden surveillance camera located at the Sea Galley at 4101 Credit Union Drive in Anchorage,. 
Alaska captured a similarly dressed male park in the extreme southwest comer of the Sea Galley 
parking lot driving a silver Nissan Xtenra. From the surveillance video, the male appeared to 
exit the vehicle and walk westbound across the street to the Alaska USA and return a short while 
later. Both the male’s appearance and timing are commensurate with him. being the person who 






attempted to withdraw the money. 


21. On 03-01-2012 at approximately 00:28 AST, $500.00 in US currency was 
withdrawn from the ATM at the Alaska USA located at 7701 Debarr Road in Anchorage, 

Alaska. As with the prior two transactions, the debit card utilized to withdraw the money was 
the Credit Union 1 debit card issued to D.T. 

22. On 03-07-2012 at approximately 21:57 AST, $400.00 in US currency was 
withdrawn from the ATM at the Western Bank located at 200 West Rex Allen Road in Willcox, 
Arizona. The debit card utilized to withdraw the money was the Credit Union 1 debit card 
issued to D.T. Surveillance video on the ATM showed the individual using the debit card for 
the withdrawal was a white male dressed in a gray hooded jacket or sweatshirt, glasses, a gray 
face mask, gray gloves, dark-colored pants, and light-colored shoes, and appeared to be driving a 
late model white Ford Focus sedan. 

23. On 03-07-2012 at approximately 23:24 AST, there was an attempted $400.00 
withdrawal at the Western Bank located at 711 Main Street in Lordsburg, New Mexico, using 
D.T.’s Credit Union 1 debit card (the same card referenced in prior paragraphs.) The withdrawal 
Avas declined by the ATM as it would have put the debit card over the daily withdrawal limit. 

At23:25 AST, at the same ATM, a balance inquiry was conducted on the account utilizing the 
debit card. The balance shown was $3,598.91. At 23:26 AST, $80.00 was withdrawn from the 
account utilizing the debit card. Surveillance video on the ATM showed the individual using the 
debit card wore similar clothing to the first ATM withdrawal in Arizona. 

• 24. On 3-9-2012 at approximately 23:23 AST, there was a $483.00 withdrawal made 

at an ATM at Houston Community Bank, 1515 FM 1960 Bypass East, Humble City, Texas. 
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Initial review of the surveillance video from the ATM appeared to show that the individual using 
the debit card wore similar clothing to that wom during the two aforementioned ATM 
withdrawals in Arizona and New Mexico. 

25. On 03-11-2012 at approximately 23:47 AST, there was a $480.00 withdrawal at 
the People's State Bank located at 5850 Hwy 59 South, Shepherd, Texas using D.T.’s Credit 
Union 1 debit card (the same card referenced in prior paragraphs.) Surveillance video on the 
ATM showed the individual using the debit card wore similar clothing to the first ATM 
withdrawal in Arizona, as well as the subsequent withdrawals in New Mexico and Texas. 

Stop of the White Ford Focus 

26. On 03/13/2012, at approximately 11:00 Central Time (CT), Texas Ranger Steven 
Rayburn, was notified by Texas Department of Public Safety (DPS) Highway Patrol Corporal 
Bryan Henry (Corporal Henry) that a white Ford Focus sedan bearing Texas license plate 
DH4N930 was observed parked at the Quality Inn & Suites (QIS), 4306 South First Street, 
Lufkin, Texas, which is a short drive from Shepherd, Texas. 

27. On 03/13/2012, at approximately 11:15 CT, Ranger Rayburn responded to the 
QIS, at which time FBI Agent Deb Gannoway conducted a walk-by and visual inspection of the 
white Ford Focus. Gannoway noted a bar-code sticker on the driver's side back passenger 
window consistent with stickers applied to rental vehicles. She also noted numerous items of 
clothing, trash and other debris in plain sight within the vehicle, including what appeared to be a 
fe;irl'.i;.Ar woman's pink item of clothing. Ranger Rayburn caused a Texas license plate database 
■search tp be conducted which revealed the white 2012 Ford Focus was registered to PV Holding 
Corporation, 9603 John Saunders Road, San Antonio, Texas. DPS Criminal Investigative 
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Division (CID) Lieutenant Mickey Hadnot (Lieutenant Hadnot) maintained surveillance on the 
Ford Focus. 

28. On 03/13/2012, at approximately 11:30 CT, Lieutenant Hadnot reported to 
Ranger Rayburn, that a white male adult exited room 215 of the QIS, placed some items into the 
trunk of the aforementioned white Ford Focus, and departed the scene alone, driving the white 
Ford Focus. FBI Agent Deb Gannoway had previously obtained from the QIS front desk 
manager an "in house list" of all occupants of the QIS on the night of 03/12/2012, which 
reflected room 215 was rented by ELIJAH KEYES for the time period 03/09/2012 through 
03/13/2012. • 

29. On 03/13/2012, at approximately 11:45 CT, Corporal Henry conducted a traffic 
stop on the white Ford Focus sedan based in part on FBI Agent Deb Gannoway’s suspicion that 
the vehicle was the same vehicle used in the Arizona, New Mexico, and Texas ATM 
withdrawals, as well as Corporal Henry's assessment that the driver of the vehicle was traveling 
in excess of the posted speed limit. Corporal Henry provided to FBI Agent Deb Gannoway 
Alaska Driver's License number 7268639, in the name of ISRAEL KEYES, which KEYES had 
provided to Corporal Henry. KEYES informed Corporal Henry he flew from Anchorage, 

Alaska, to Las Vegas, Nevada, on 03/07/2012, and that he rented the white Ford Focus at the Las 
Vegas airport, driving to his present location over the course of the ensuing week. KEYES 
provided to law enforcement officers a copy of his car rental agreement, which corroborated his 
statement that he had rented the car at the Las Vegas, Nevada,.airport on 03/07/2012. KEYES 
was unable to describe to law enforcement officers the route he drove from Nevada to Texas, but 
stated he was in Lufkin, Texas, to attend his sister’s wedding in Wells, Texas. KEYES told 
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officers he "probably" paid for fuel throughout his travels from Nevada to Texas with cash. 
Ranger Rayburn observed that there was a pair of large white tennis shoes partially pushed under 
the driver's seat of the Ford Focus, which Ranger Rayburn could plainly see through the window. 
During questioning by FBI Agent Gannoway and Ranger Rayburn, KEYES became increasingly 
agitated and uncooperative, and he refused to allow Ranger Rayburn to inspect his wallet (which 
was in his pocket) or his vehicle. KEYES became unusually nervous and began to sweat 
profusely, in spite of the slightly cool weather and the tank top which he was wearing at the 
time. KEYES expressed that if he was going to be kept in the area for a longer period of time, 
he desired to call his brother (who has KEYES' daughter in a separate car) and notify him of 
same. Officers suggested KEYES make that call. A short time later, the 2012 Ford Focus was 
transported to and secured at the Lufkin, Texas, Police Department. 

30. Based on the aforementioned observations, including the fact that the rented Ford 
Focus matched the description of the vehicle utilized in the ATM withdrawals in Arizona, New 
Mexico and Texas, KEYES' arrival in Las Vegas, Nevada, and his subsequent travel from 
Nevada to Texas veiy likely resulting in KEYES traveling through Arizona on or about 
03/07/2012 (the date of a $400.00 ATM withdrawal in Arizona) and New Mexico on or about 
03/08/2012 (the date of an $80.00 ATM withdrawal in New Mexico), KEYES' appearance 
closely matching the description of the white male adult observed in videos of the above- 
described ATM withdrawals, KEYES' own admission that he lived in the Anchorage, Alaska, 
area, KEYES' Alaska driver's license reflecting an Anchorage, Alaska, address, the white tennis 
shoes under the driver's seat matching the description of the shoes worn by the white male adult 
observed in the videos of the above-described ATM, as well as other observations, Corporal 
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Henry placed KEYES under arrest. Ranger Rayburn searched KEYES’ wallet, revealing a VISA 
ATM/Debit card bearing account number XXXXXXXXXXXX2851, expiration date 01/15, in 
the name of D.T. This card is linked to the “ransom account” identified above, from which the 
withdrawals and attempted withdrawals summarized above were made. The search of KEYES 
pursuant to his arrest also revealed an AT&T Pantech flip cellular phone, blue and silver in 
color, Model #P2000, S/N 110301023456. 

Discovery ofKEYESI White Chevrolet Truck 

31. APD Detectives discovered that ISRAEL KEYES listed a mailing address of 
3705 Arctic Blvd. #2891 in Anchorage, Alaska, on 07-18-2011, which is the Mail Cache. APD 
Detectives also discovered that KEYES listed a residential address of 2456 Spun Lane in 
Anchorage, Alaska, as of 07-18-2011. 

32. On 03-13-2012 at approximately 10:30 AST, members of the APD Special 
Assignment Unit went to KEYES’ home address at 2456 Spurt Lane in Anchorage, Alaska. No 
one answered repeated knocks on the door. Per APD Sergeant Redick, there were fresh tire 
impressions in the snow in the driveway of the address that appeared as if a vehicle had been 
parked there as recently as the morning of 03-13-2012, 

33. There was also a white Chevrolet pickup truck parked in the driveway of the 
address. The truck had a large toolbox in the bed and a ladder rack on top. The bolts securing 
those items were removable and appeared to have been recently added. The license plate on the 
truck was Alaska license plate FTC990, relating to a white 2004 Chevrolet Silverado, registered 
to ISRAEL KEYES at 2456 Spun Lane in Anchorage, Alaska. The white Chevrolet truck 
appeared to match the vehicle appearing in the Home Depot surveillance video, as summarized 





above. Further, Detectives eventually contacted KEYES’ girlfriend and discovered that she 
drives a 2007 Nissan Xterra, which matched the general description of the vehicle used by an 
individual who appeared to attempt to use the stolen debit card on 2-29-12, as summarized 
above. 

Discovery OF KEYES’ Computer Use and Use of Yahoo Account 

34. KEYES’ girlfriend, who also lives at his residence, was interviewed on 
approximately March 14,2012. She indicated KEYES was out of Alaska. She also indicated 
that KEYES owned a laptop computer and that his computer was not in the residence. 

35. Alaska Airlines provided travel records for KEYES pursuant to a Federal Grand 
Jury Subpoena that was issued to them on March 14,2012. In reviewing the returns for this 
subpoena, travel records were found showing KEYES and his young daughter traveled to 
Houston on February 2,2012. KEYES was originally scheduled to return on February 14, 2012 
but changed the ticket to return on February 17,2012. The ticket was booked online October 1, 
2011 and an email confirmation was sent on the same date. The return ticket was changed to 
February 17, 2012 and an email confirmation was sent on 2/15/2012. The notes for this 
transaction indicate the email confirmation was sent to an email address believed to belong to 
A.K., the mother of KEYES’ daughter. However, the tickets were booked using A.K.’s credit 
card. A.K.does not reside in the state of Alaska and it is likely she had to forward the email 
confirmation to KEYES so that he would know the dates/times of travel. 

36. In reviewing the returns for this subpoena, travel records were also found showing 
KEYES and his young daughter traveled to Las Vegas on March 6,2012 via Alaska Airlines. 
This ticket was booked online and he provided an email address with the reservation. The notes 
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section of the travel records indicated the email address provided was 
israelkeves@vahoo.com . The records also indicated an email confirmation was sent to 
israelkeves@vahoo.com on March 1, 2012. 

Execution of Search Warrant and Discovery of Cellular Telephone Matching 
Description of Phone Belonging to S.K. and Other Cellular Telephones and Digital Media 
Devices 

37. On March 16,2012, law enforcement agents in Beaumont, Texas obtained a search 
warrant which authorized the search of the white Ford Focus driven by KEYES. Execution of 
that search warrant on March 17, 2012 revealed numerous items, including a Samsung 
cellphone, black in color, slider type. Model# SCH-R631. Possible S/N 80015743 (this number 
is on the back of the phone but it does not indicate it as a S/N), which matched the description of 
S.K.’s cellular phone provided by S.K.’s boyfriend (per paragraph 9, S.K. is believed to have 
been carrying the phone when the kidnapping took place), a laptop computer; a DVD case; a 
Sony Cybershot Camera, silver in color, Model #DSC-S700, S/N 0522961; and a Sandisk M250 
MP3 Player, black in color, 2 GB. The laptop computer, Samsung cellular phone, Sony 
Cybershot Camera, and Sandisk M250 MP3 player were all seized pursuant to the search of the 
vehicle. The DVD case was initially not seized, but were rather returned to KEYES mother, 
HEIDI KEYES. 

38. In my training and experience, I know that photos from digital cameras and 
cellular phones are frequently downloaded to computers and electronic tablets, and then printed 
or stored on media devices. I also know that cellular phones, computers, electronic tablets and 
similar devices are frequently used to arrange travel and hotel reservations, rent vehicles, and 


16 





• • 


conduct other personal business related to traveling. I also know that computers and cellular 
phones can be used to connect to the internet, which can be used to locate banks, ATM’s, hotels, 
maps, send email, draft documents, and communicate with others. I also know that storage 
devices for electronic information, or “thumb” drives, are often used to store such information 
for later use by computers, cellular phones and other media devices. I know that electronic 
records of all such uses of computers and similar electronic devices are retained within those 
devices and may be retrieved by forensic technicians. 

Interview of KEYES 

39. In an interview with defense counsel present on March 17,2012, KEYES admitted 
to using D.T.’s debit card at locations throughout the southwest United States. He also claimed 
that he received the debit card and the cellular telephone matching the description of S.K.’s 
telephone together in a plastic bag from an anonymous person, who left the plastic bag in his 
vehicle. Based on my training and experience, it appears very likely that the specifics of 
KEYES’ account of the origin of his possession of the phone and debit card is not truthful, 
however, his admission that the phone and debit card are associated with each other associates 
both items with S.K., and confirms the identification of the phone as belonging to S.K. During 
the interview, KEYES also indicated that a Micro SD Card belonging to the phone matching the 
description of S.K.’s phone was located within the DVD case that had been present in the white 
Ford Focus and had been returned to KEYES mother, HEIDI KEYES, following the search of 
that vehicle. 

Cnnsftnsual Seizure of Lexar 4GB Micro SD car d and I ,G Cellular Telephone 
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40. Following the interview with KEYES, law enforcement officers visited KEYES 
mother, HEIDI KEYES. During this visit, officers were informed that KEYES’ daughter, L.K., 
who had been intermittently traveling with KEYES from March 6,2012 through March 13, 

2012, was in possession of a black flip-out LG Cellular Telephone S/N 104CYHE2202705, 

L.K. indicated that she had possessed this cellular phone while traveling with KEYES and that 
he had access to it throughout their intermittent travels. Officers requested that HEIDI KEYES, 
who was supervising L.K., consent to provide the black flip-out LG Cellular Telephone S/N 
104CYHE2202705. HEIDI KEYES consented to provide the phone, and officers subsequently 
seized it. Officers also requested that she allow officers to examine the DVD case found in the 
white Ford Focus and released to her, which KEYES had indicated in his interview contained a 
Micro SD chip for the cellular phone belonging to S.K. HEIDI KEYES consented to allow an 
examination of the DVD case. Pursuant to that examination, officers discovered a Lexar 4GB 
Micro SD card that appears to fit the cellular telephone belonging to S.K. HEIDI KEYES then 
consented to provide the SD Card to officers. Officers subsequently seized the SD card. 

40. The Devices listed at paragraph 2, above, are currently in the lawful possession of 
the FBI. The Devices came into the FBI possession as outlined above. Although the FBI might 
already have the lawful authority to examine the Devices, I seek this additional warrant out of an 
abundance of caution to be certain that an examination of the Devices will comply with the 
Fourth Amendment and other applicable laws. 

41. The Devices are currently in storage at FBI Anchorage Station, Anchorage, Alaska. 
In my training and experience, I know that the Devices have been stored in a manner in which 
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their contents are, to the extent material to this investigation, in substantially the same state as 
they were when the Devices first came into the possession of the government. 

TECHNICAL TERMS 

42. Based on my tr aini ng, my experience, and information provided to me by other 
law enforcement personnel, I use the following technical terms to convey the following 
meanings: 

a. “Storage medium”: A storage medium is any physical object upon 
which data can be stored, including a cellular telephone’s flash 
memory or other data storage components, such as a SIM card. 

b. “Wireless telephone”: A wireless telephone (or mobile telephone, 
or cellular telephone) is a handheld wireless device used for voice 
and data communication through radio signals. These telephones 
send signals through networks of transmitter/receivers, enabling 
communication with other wireless telephones or traditional “land 
line” telephones. A wireless telephone usually contains a “call 
log ” which records the telephone number, date, and time of calls 
made to and from the phone. In addition to enabling voice 
communications, wireless telephones offer a broad range of. 
capabilities. These capabilities include: storing names and phone 
numbers in electronic “address books”; sending, receiving, and 
storing text messages and e-mail; taking, sending, receiving, and 
storing still photographs and moving video; storing and playing 
back audio files; storing dates, appointments, and other 
information on personal calendars; and accessing and 
downloading information from the Internet. Wireless telephones 
may also include global positioning system (“GPS”) technology 
for determining the location of the device. 

c. “Computer”: Pursuant to 18 U.S.C. § 1030(e)(1), a computer is 
“an electronic, magnetic, optical, electrochemical, or other high 
speed data processing device performing logical or storage 
functions, and includes any data storage facility or 
communications facility directly related to or operating in 
conjunction with such device.” 
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d. IP Address: An Internet Protocol address (or simply “IP Address”) 
is a unique numeric address used by computers on the Internet. 

An IP address is a series of four numbers, each in the range 0-255, 
separated by periods (e.g., 121.56.97.178). Every computer 
attached to the Internet must be assigned an IP address so that 
Internet traffic sent from and directed to that compuiter may be 
directed properly from its source to its destination. Most Internet 
service providers control a range of IP addresses. Some computers 
have static- that is, long-term - IP addresses, while other 
computers have dynamic - that is, frequently changed - IP 
addresses. 

e. Internet: The Internet is a global network of computers and othe 
electronic devices that communicate with each other. Due to the 
structure of the internet, connections between devices on the 
internet often cross state and international borders, even when the 
devices communicating with each other are in the same state. 


f. Portable media player: A portable media player (or “MP3 Player” 
or iPod) is a handheld digital storage device designed primarily to 
store and play audio, video, or photographic files. However, a 
portable media player can also store other digital data. Some 
portable media players can use removable storage media. 
Removable storage media include various types of flash memory 
cards or miniature hard drives. This removable 

storage media can also store any digital data. Depending on the 
model, a portable media player may have the ability to store very 
large amounts of electronic data and may offer additional features 
such as a calendar, contact list, clock, or games. 

g. Digital camera: A digital camera is a camera that records pictures 
as digital picture files, rather than by using photographic film. 
Digital cameras use a variety of fixed and removable storage 
media to store their recorded images. Images can usually be 
retrieved by connecting the camera to a computer or by connecting 
the removable storage medium to a separate reader. Removable 
storage media include various types of flash memory cards, SD 
cards or miniature hard drives. Most digital cameras also include 
a screen for viewing the stored images. This storage media can 
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contain any digital data, including data unrelated to photographs or 
videos. 

h. Secure Digital (SD) Card: A Secure Digital (“SD”) Card is a 
removable computer memory chip for use in portable devices, 
including cellular phones, MP3 players and digital cameras. SD 
cards store digital data in a format usable by a particular electronic 
device. 

43 Based on my training, experience, and research, I know that the Target 
Devices have capabilities that allow them to serve as a wireless telephone, digital camera, 
memory storage, and may also function as a computer and internet browser. In my training and 
experience, examining data stored on devices of this type can uncover, among other things, 
evidence that reveals or suggests who possessed or used the device. 

ELECTRONIC STORAGE AND FORENSIC ANALYSIS 

44. The applied-for warrant would authorize the forensic examination of the 
Target Devices for the purpose of identifying and seizing the electronically stored information 
particularly described in Attachment B in accordance with Federal Criminal Procedure Rule 
41(e)(2)(B) (“Warrant Seeking Electronically Stored Information”). 

45. Forensic evidence : As further described in Attachment B, this application 
seeks permission to locate not only electronically stored information that might serve as direct 
evidence of the crimes described on the warrant, but also forensic evidence that establishes how 
the Target Devices were used, the purpose of their use, who used them, and when. There is 
probable cause to believe that this forensic electronic evidence more likely than not is stored in 
the Target Devices because: 


Data on a storage medium can provide evidence of information 
that was once on the storage medium but has since been deleted or 






edited, or of a deleted portion of the information. 

b. Forensic evidence stored within the Target Devices can also 
indicate who has used or controlled the Target Devices. This 
“user attribution” evidence is analogous to the search for “indicia 
of occupancy” while executing a search warrant at a residence. 

c. A person with appropriate familiarity with how the Target Devices 
works may, after examining this forensic evidence in its proper 
context, be able to draw conclusions about how electronic devices 
were used, the purpose of their use, who used them, and when. 

d. The process of identifying the exact electronically stored 
information on a storage medium that are necessary to draw an 
accurate conclusion is a dynamic process. Electronic evidence is 
not always data that can be merely reviewed by a review team and 
passed along to investigators. Whether data stored on a cellular 
telephone is evidence may depend on other information stored on 
the cellular telephone and the application of knowledge about how 
a cellular telephone operates. Therefore, contextual information 
necessary to understand other evidence also falls within the scope 
of the warrant. 

e. Further, in finding evidence of how the Target Devices was used, 
the purpose of its use, who used it, and when, sometimes it is 
necessary to establish that a particular thing is not present on a 
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storage medium. 

f. Based on my knowledge, training and experience, I know that 

electronic devices can store information for long periods of time. 
Similarly, things that have been viewed via the internet are 
typically stored for some period of time on the device. This 
information can sometimes be recovered with forensics tools. 

46. Nature of examination : Based on the foregoing, and consistent with Rule 
41(e)(2)(B), the warrant I am applying for would permit the examination of the Target Devices 
consistent with the warrant. The examination may require authorities to employ techniques, 
including but not limited to computer-assisted scans of the Target Devices’ entire storage 
medium, that might expose many parts of the devices to human inspection in order to determine 
whether it is evidence described by the warrant. 

47. Manner of execution : Because this warrant seeks only permission to 
examine a cellular telephone already in law enforcement’s possession, the execution of this 
warrant does not involve the physical intrusion onto a premises. Consequently, I submit there is 
reasonable cause for the Court to authorize execution of the warrant at any time in the day or 
night. 

48. Forensic image retention : I hereby request judicial authorization to retain . 
full copy of the Devices’ storage media after the review is complete (to the extent that this 
warrant does not already authorize me to retain that storage media as seized forfeitable property) 
and until further order of the Court. That judicial authorization is justified in this case in part 
because: 
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Should the execution of the warrant uncover data that may later 
need to be introduced into evidence during a trial or other 
proceeding, the authenticity and the integrity of the evidence and 
the government’s forensic methodology may be contested issues. 
Retaining copies of seized storage media can be required to prove 
these facts. 

Returning the original storage medium to its owner will not allow 
for the preservation of that evidence. Even routine use of a 
cellular telephone may forever change the data it contains or 
eliminate data stored on it 

Because the investigation is not yet complete, it is not possible to 
predict all possible defendants against whom evidence found on 
the storage medium might be used. That evidence might be used 
against persons who have no possessory interest in the storage ■ 
media, or against persons yet unknown. Those defendants might 
be entitled to a copy of the complete storage media in discovery. 
Retention of the entire content of the storage medium assures that 
it will be available to all parties, including those known now and 
those later identified. 

The act of destroying or returning a Device could create an 
opportunity for a defendant to claim, falsely, that the destroyed or 
returned Devices contained evidence favorable to him. 




Maintaining a copy of the Devices’storage medium would permit 
the government, through an additional warrant if necessary, to 
investigate such a claim. 

■ e. Similarly, should a defendant suggest an explanation for the 

presence of evidence on a storage medium, it may be necessary to 
investigate such an explanation by, among other things, 
re-examining the storage medium with that defense in mind. This 
may require an additional examination of the storage medium for 
evidence that is described in Attachment B but was not properly 
identified and segregated previously. 

CONCLUSION 

49. Based on my training and experience, and the facts as set forth in this affidavit, 
there is probable cause to believe that on the following Devices, as set forth in paragraph 2 
above: 

a) BLACK LG CELLULAR TELEPHONE, s/n 104CYHE2202705, 
further identified in Attachment A, for the information identified in Attachment B. 

There exists fruits, evidence, and instrumentalities of violations of Title 
18, United States Code (USC), Section 1029(a)(5) (Fraud and Related Activity in Connection 
with Access Devices )(FRACAD); Title 18, United States Code, Section 1201 (Kidnaping); and 
Title 18, United States Code, Section 1202(b) (Ransom Money). 

50. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. §2711. 18 U.S.C. §§ 2703(a), (b)(1)(A) & 






(c)(1)(A). Specifically, the Court is “a district court of the United States ... that - has 
jurisdiction over the offense being investigated.” 18 U.S.C. § 2711(3)(A)(I). 

51 . The investigation of this case is ongoing and disclosure of the issuance of the 
search warrant could result in destruction of evidence and could also impact officer, witness and 
victim safety. Accordingly, pursuant to the case law outlined in the government’s motion to 
seal, I respectfully request that the search warrant, search warrant affidavit, attachments, and 
returns be sealed. 

Further vour Affiant saveth naught. 

Isl Signature Redacted 

Special Agent Jolene Goeden 

Federal Bureau of Investigation 

, r . 

-SUBSCRIBED' ari’d,SWORN to before me 

J ; -'this 2012. 

. . 

S'' i/s/J oh n D. Roberts, USMJ 
'^#Signature Redacted 

” ^ n .%ite,q^e|^a|istrate Judge 
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Anchorage, Alaska 99513-7567 

Phone: (907) 271-5071 

Fax: (907) 271-1500 

E-mail: craig.wamer@usdoj.gov 


IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF ALASKA 


In the Matter of the Search of: ) Case No.3:12-mj-00136-JDR 

) ■ 

BLACK LG CELLULAR ) MOTION TO SEAL SEARCH 

TELEPHONE ) WARRANT, APPLICATION, 

S/N 104CYHE2202705 ) AFFIDAVIT FOR SEARCH 

) WARRANT, ATTACHMENTS, 

) AND RETURN 

) 

_) FILED UNDER SEAL 

COMES NOW the United States of America, by and through undersigned 
counsel and hereby moves for an order sealing the Search Warrant, Application 
and Affidavit and Returns for the search warrant issued in the above-captioned 
matter until further order of this Court. 


The government makes this motion to protect the investigative integrity of 
the present case. The investigation of this case is ongoing and disclosure of the 




issuance of the search warrant could result in destruction of evidence and could 


also impact officer, witness and victim safety. 

Historically, courts have recognized a “general right to inspect and copy 
public records and documents, including judicial records and documents.” 
Kamakana v. City and County of Honolulu. 447. F.3d 1172, 1178 (9th Cir. 2006) 
citing Nixon v. Warner Communications. Inc.. 435 U.S. 589, 597 & n.7 (1978). 
Nonetheless, access to judicial records is not absolute. A narrow range of 
documents is not subject to the right of public access at all because the records 
have “traditionally been kept secret for important policy reasons.” Id citing 
Times Mirror Co. V. United States. 873 F.2d 1210, 1219 (9th Cir. 1989). Ninth 
Circuit case law has identified two categories of documents that fall into this 
category: grand jury transcripts and warrant materials in the midst of a pre¬ 
indictment investigation. Id Parties seeking to seal a judicial record not 
traditionally kept secret must provide compelling reasons to the court for doing so. 
Id. In general, “compelling reasons” are those sufficient to outweigh the public’s 
interest in disclosure. Id. at 1179. 

Based on the foregoing, the government respectfully requests this Court 

enter the attached proposed Order sealing said search warrant, Application and 
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Affidavit for Search Warrant, the Returns and this Motion and Order until said 
time as the government has time to review the information contained therein and 
act upon. 

RESPECTFULLY SUBMITTED this 22th day of March, 2012, in 
Anchorage, Alaska. 


KARENS. LOEFFLER 


Isl Signature Redacted /s/Signature Redacted 

01 V_/1 aia/jvi. VY aiiioi _ 

Assistant U.S. Attorney 

Federal Building & U.S. Courthouse 

222 West Seventh Avenue, #9, Room 253 

Anchorage, Alaska 99513 

Phone: (907) 271-5071 

Fax:(907)271-1500 

E-mail: craig.wamer@usdoj.gov 
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• IN THE UNITED STATES DISTRICT COURT 


FOR THE DISTRICT OF ALASKA 

In the Matter of the Search of: ) Case No. 3:12-MJ-00136-JDR 

) 

BLACK LG CELLULAR ) ORDER GRANTING MOTION 

TELEPHONE S/N 104CYHE2202705 ) TO SEAL SEARCH WARRANT, 

) APPLICATION, AFFIDAVIT 
) FOR SEARCH WARRANT, 

) ATTACHMENTS AND 
) RETURN 
) 

_) FILED UNDER SEAL 


The United States requests that the Search Warrant, Application, Affidavit, 
Attachments and the Return filed in the above-captioned case be sealed. 

This Court finds that the need for secrecy to protect the ongoing 
investigation and potential witnesses outweighs the public’s right to inspect and 
copy judicial records and documents. 

IT IS HEREBY ORDERED that: 


The Search Warrant, Application, Affidavit and Attachments filed in the 
above-captioned case, and the Return to be filed, be sealed until further order of 
this Court. 

Further, the United States Attorney’s Office is directed to notify the Court 

/ 

// 






// 

as soon as the need for secrecy passes by filing a motion to unseal records. 
DATED this 22nd day of March, 2012, at Anchorage, Alaska^ . " 

/s/John D. Roberts, USMJ 
r —'Signature Redacted '.y? •" _ 

NJCHN D.ROBJJIIjS^- 

United States Magistrate Judge " / 
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United States District Court 

_ District of _ Alaska _ 

In the Matter of the Search of 

(Name, address or brief description of person or property to be searched) 

SEARCH WARRANT 

Blue and silver AT&T Pantech cellular telephone, 

Model #P2000, S/N 110301023456 


VV* * r ^ 

W A O "93 (Rev. 12/03) S earch Warrant 


Case Number:- 3:12-mj-000137-JDR 


TO: _ S/A Jolene Goeden, FBI _and an y Authorized Officer of the United States 

Affidavit(s) having been made before me by _ S/A Jolene Goeden, FBI _ who has reascm t0 believe 

Affiant 

that DO on the person of, or 0Qon the premises known as (name, description and/or location) 

See Attachment A, which is incorporated by reference, 


in the _District of _ Alaska _there is now 

concealed a certain person or property, namely (describe the person or property) 

See Attachment B, which is incorporated by reference. 


I am satisfied that the affidavit(s) and any record testimony establish probable cause to believe that the person or property so described 
is now concealed on the person or premises above-described and establish grounds for the issuance of this warrant. 

YOU ARE HEREBY COMMANDED to search on or before _ 4/1/2012 _ 

Date 

(not to exceed 10 days) the person or place named above for the person or property specified, serving this warrant and making the 
search 0 in the daytime — 6:00 AM to 10:00 P.M. □ at anytime in the day or night as 1 find reasonable cause has been 
established and if the person or property be found there to seize same, leaving a copy of this warrant and receipt for the person 
or property taken, and prepare a written inventory of the person or property seized and promptly return this warrant to 

_ g&Ka/k _ as re 0 uired hy law - 

U.S. Magistrate Judge (Rule 41(f)(4)) 


^OlVyjL ZUih. <vt" C: yo at /WWaV,,, iMc&ka 

Date and Time Issued " City and.SVate' ^ 

JOHN D. ROBERTS ? is/John D. Roberts, USMJ 

U. S. MAGISTRATE JUDGE signal ^Signature Redacted 

- :\J ' 



















ATTACHMENT A 


The property to be searched is an AT&T Pantech cellular telephone, blue and silver in 
color, Model #P2000, S/N 110301023456, currently located at non-drug evidence locker at FBI 
Anchorage, 101 East 6 ,h Avenue, Anchorage, Alaska 99501. -- 





ATTACHMENT B 


All records and information on the Target Device identified in Attachment A that relate to 
violations of Title 18, United States Code (USC), Section 1029(a)(5) (Fraud and Related Activity 
in Connection with Access Devices )(FRACAD); Title 18, United States Code, Section 1201 
(Kidnapping); and Title 18, United States Code, Section 1202(b) (Ransom Money), and involve 
ISRAEL KEYES, including: 


1. Evidence of who used, owned, or controlled the Target Device and evidence of 
the Target Device contacting or communicating with other cellular phones or 
electronic devices, including text messages, application data, calender entries, 
notes, call records, contact or address book entries, photos, location information, 
and Internet browser history/cache. 

2. Evidence of the times the Target Device was used. 

3. The substantive content of any text communications to or from the Target Device. 

4. Contextual information necessary to understand the evidence described in this 
attachment. 

As used above, the terms “records” and “information” include all of the foregoing items 
of evidence in whatever form and by whatever means they may have been created or stored, 
including any form of computer or electronic storage. _ _ ^ 




AO 106(Rev. 04/10) Application fora Search Warrant 


United States District Court 

for the 

District of Alaska 


In the Matter of the Search of ^ 

(Briefly describe the property to be searched ) 

or identify the person by name and address) ) Case No, 3:12-mj-000137-JDR 

Blue and silver AT&T Pantech cellular telephone, Model ) 

#P2000, S/N 110301023456 > 

APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penally of perjury that I have reason to believe that on the following person or property (identify the person or describe the 

(s incorporated herein by reference 


located in the ’_ District of_ Alaska _, there is now concealed (identify the 

person or describe the property to be seized)'. 

See Attachment B, which is incorporated herein by reference 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
gf evidence of a crime; 

□ contraband, fruits of crime, or other items illegally possessed; 

l 5 l { property designed for use, intended for use, or used in committing a crime; 

0 a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 

Code Section 

18 U.S.C. 1029(a)(5) Access Device Fraud 

18U.S.C. 1201 Kidnapping 

18 U.S.C. 1202(b) Ransom Money 


Offense Description 


The application is based on these facts: 

See Attached Affidavit, which is incorporated herein by reference 


sf Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days:_) is requested 

under 18 U.S.C. § 3103a, the basis of which is set forth on **«» eWt 

/s/ Signature Redacted 

Applicant’s signature 

_ Jolene Goeden, FBI Special Agent _ 

Printed name and title 


Sworn to before me and signed in my presence. 

Date: 03/22/2012 

City and state: Anchorage, Alaska _ 




^/s/John D. Roberts, USMJ 


^Signature Redacted 


>hh D. Roberts, Magistrate Judge 


Printed name andtide 








ATTACHMENT B 


All records and information on the Target Device identified in Attachwot. A that relate to 
violations of Title 18, United States Code (USC), Section 1029(a)(5) (P. nid and delated Activity 
in Connection with Access Devices )(FRACAD); Title 18, United States OjUe, Section 1201 
(Kidnapping); and Title 18, United States Code, Section 1202(b) (Ransbwi Money), and involve 
ISRAEL KEYES, including: 

1. Evidence of who used, owned, or controlled the Target Device and evidence of 
the Target Device contacting or communicating with other cellular phones or 
electronic devices, including text messages, application data, calender entries, 
notes, call records, contact or address book entries, photos, location information, 
and Internet browser history/cache. 

2. Evidence of the times the Target Device was used. 

3. The substantive content of any text communications to or from the Target Device. 

4. Contextual information necessary to understand the evidence described in this 
attachment. 

As used above, the terms “records” and “information” include all of the foregoing items 
of evidence in whatever form and by whatever means they may have been created or stored, 
including any form of computer or electronic storage. 
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UNITED STATES DISTRICT COURT 
THE DISTRICT OF ALASKA 


IN THE MATTER OF THE SEARCH OF 

) Case No. 3:12-mj-00137-JDR 

) 

BLUE AND SILVER AT&T PANTECH 
CELLULAR PHONE, MODEL #P2000, 

S/N 110301023456 

) 

) 

) 

) 

) 

' ) 

) 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 

I, Jolene Goeden, being first duly sworn, hereby depose and state as follows: 

INTRODUCTION AND AGENT BACKGROUND 

1. I am a Special Agent of the Federal Bureau of Investigation (FBI). I have been a 

Special-Agent of the FBI since April 2004. I am charged with the duty of investigating violations 

of the laws of the United States, collecting evidence in cases in which the United States is or may 

be a party in interest, and performing other duties imposed by law. I have been assigned to 

investigate most criminal matters within the jurisdiction of the FBI, including kidnapping 

matters, fraud matters and other white collar crime. 

2. I make this affidavit in support of an application under Rule 41 of the Federal Rules of 
Criminal Procedure for a warrant to search five electronic items seized during a common set of 
searches and pursuant to a common set of circumstances, as outlined below : 

a) BLUE AND SILVER AT&T PANTECH CELLULAR PHONE, MODEL 
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#P2000, S/N 110301023456, further identified in Attachment A, for the information identified in 
Attachment B. 

This item is currently located at FBI Anchorage at 101 East Sixth Avenue, Anchorage, 
Alaska, in the secure, non-drug evidence vault. 

3. As set forth herein, there is probable cause to believe that in the property to be searched 
there exists evidence of a crime, contraband, fruits of a crimes, or other items illegally possessed 
in violation of Title 18, United States Code (USC), Section 1029(a)(5) (Fraud and Related 
Activity in Connection with Access Devices )(FRACAD); Title 18, United States Code, Section 
1201 (Kidnapping); and Title 18, United States Code, Section 1202(b) (Ransom'Money), as 
further described in Attachment A. 


RELEVANT STATUTES 

4. The Target Device contains evidence of and is an instrumentality used for 
violations of Title 18, USC, Section 1029(a)(5), Fraud and Related Activity in Connection with 
Access Devices, which provides that: 

Whoever, knowingly and with intent to defraud effects transactions with 1 or more access 
devices issued to another person or persons, to receive payment or any other things of 
value during any 1-year period that aggregate value of which is equal to or greater than 
$ 1 , 000 ; 

and Title 18, United States Code, Section 1201 (Kidnaping), which provides that: 

Whoever unlawfully seizes, confines, inveigles, decoys, kidnaps, abducts, or carries away 
and holds for ransom or reward or otherwise any person, except in the case of a minor by 
the parent thereof, when the person is willfully transported in interstate or foreign 
commerce, regardless of whether the person was alive when transported in interstate or 
foreign commerce or uses the mail or any means, facility, or instrumentality of interstate 
or foreign commerce in committing or in furtherance of the commission of the offense; 

and Title 18, United States Code, Section 1202(b) (Ransom Money), which provides that:. 
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Whoever receives, possesses, or disposes of any money or other property, or any portion 
thereof, which has at any time been delivered as ransom or reward in connection with a 
violation of section 1201 of this title, knowing the same to be money or property which 
has been at any time delivered as such ransom or reward. 

6. The applied for warrant would authorize the forensic examination of the devices listed 
above in paragraph 2, and further identified in Attachment A, for the purpose of identifying 
electronically stored data particularly described in Attachment B. 

PROBABLE CAUSE 

7. The information contained below is from my personal knowledge and experience, 
inf©r?il3t\bn provided to me by other law enforcement personnel, or from those specific sources 
:-Ssgt forth. Since this affidavit is being submitted for the limited purpose of seeking 
authorization to search the Devices listed in paragraph 2 above, I have not included each and 
every fact known to me regarding this investigation. I have set forth only the facts that I believe 
are necessary to establish a foundation to support the aforementioned request for a search 
warrant. 

Abduction of S.K. 

B. On 2-2-12 at about 12:39 Alaska Standard Time (AST), Duncan, the owner of the 
Common Ground Coffee stand at 630 E. Tudor, Anchorage, Alaska, contacted APD dispatch. 
Duncan was calling from Oregon, where he was vacationing. He reported that while viewing his 
internet-based security system he saw one of his employees, 18-year-old S.K., appear to be 
abducted. Duncan said he was contacted by S.K.’s father (J.K.) and boyfriend (D.T.), who had 
been unable to locate her. This contact prompted Duncan to review his security video which 
showed an unknown man climb through the window of the coffee stand at about 20:00 AST on 
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2-1-12 while S.K. was working. The video appears to show S.K. retreating a short distance and 
raising her hands in an apparent sign of submission to the man who subsequently climbed into 
the coffee stand, robbed S.K. and escorted her away from the scene. The abductor climbed 
through the window into the coffee stand without any significant difficulty. He appeared to be 
significantly taller than S.K., who is 5'4" tall, but due to the limited lighting and quality of the 
video, a more accurate estimate of his height has not been made. The robber/abductor appeared 
to have a medium to large build and athletic movements. 

9. At the time of her abduction, S.K. was wearing a dark-colored jacket, a green 
shirt with light-colored stripes on the sleeves, a thin dark-colored bracelet, dark-colored pants, 
and dark-colored shoes. At the time of her abduction, S.K. was also believed to be in possession 
of a carabineer with three keys and possibly a white lanyard, a medium-to-large size leopard 
print purse, and a black cellular telephone with sliding keyboard. S.K. is a white female adult, 
approximately 5'4" tall, 150 pounds, 18 years old, with shoulder-length brown hair and brown 
eyes. 

10. Video surveillance appeared to show S.K.'s robber/abductor wearing a dark- 
colored, possibly hooded, jacket, dark-colored glasses, a dark-colored face mask, dark-colored 
gloves, dark-colored pants; and dark-colored shoes. He appeared to be carrying a white coffee 
cup and a dark-colored bag. Although to date no weapon has been conclusively identified in the 
surveillance videos that captured this robbery/abduction, the scene was generally poorly lit and 
the robber/abductor was not always fully visible. Furthermore, S.K.'s reaction appeared to be 
consistent with someone who was confronted or threatened with a weapon. In addition, during 
separate subsequent interviews, both S.K.'s father and boyfriend adamantly indicated that S.K. 


4 







# 


was very strong-willed and would not have complied with a robber or abductor's demands, 
unless she had been threatened with a weapon, 

11. Surveillance video from a nearby Home Depot at approximately 19:54 AST on 2- 
1-12 showed a white Chevrolet extended cab truck roll through the Home Depot parking lot and 
park just east of an International House of Pancakes. From a distance, the surveillance showed 
an individual with a black garment and hat get out of the truck and walk westbound through the 
parking lot towards Denali St., cross it, get on the sidewalk, walk southbound on Denali St. to 
Tudor Rd., cross Tudor Rd. at the intersection, and, finally, exit the frame. The individual’s 
travel was in the direction of the Common Ground Coffee stand, from which S.K. was abducted. 
One minute later, the video surveillance footage from Common Ground Coffee stand showed the 
individual who abducted S.K. approach from the direction of the man in the Home Depot video, 
Approximately two minutes after S.K. and her abductor exited the frame of the Common 
Ground Coffee stand video footage, two persons appearing to match S.K. and her abductor again 
entered the frame of the Home Depot video footage, this time walking back towards the location 
where the white Chevrolet truck was originally parked. The Home Depot video then showed the 
two people approach the passenger side door of the Chevrolet truck. It then showed the person 
who appeared to be S.K. enter the passenger side of truck. The other individual then walked 
around truck, entered the driver’s side, and drove out of the surveillance video’s frame. As 
described below, police have now identified KEYES’ residence and located a white Chevrolet 
truck registered to him at that residence. This white Chevrolet truck belonging to KEYES 
appears to match the vehicle in the Home Depot surveillance footage, although KEYES’ truck 
has several toolboxes and a ladder rack fastened with removable bolts to the truck bed, and these 
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items do not appear on the truck in the Home Depot video. 

12. During an interview on 02-02-2012, D.T. (S.K.’s boyfriend) said he went to the 
coffee stand on 2-1-12 at about 20:33 AST to give her a ride home but the stand appeared to be 
closed and she was not there. D.T. further reported to law enforcement that on 02/02/2012, at 
approximately 03:00 AST, he observed an unknown male adult wearing a ski mask and dark 
clothing going through the vehicle he shared with S.K. D.T. did not alert authorities to the 
burglary of the vehicle at that time. 

13. When D.T. was asked where his ATM debit card was by APD Detectives several 
days after the abduction, he indicated he had left it in the vehicle he shared with S.K. This 
vehicle had been seized by APD on 02-02-2012 and searched pursuant to a State of Alaska 
search warrant. The debit card referenced above was not located during the search; however law 
enforcement did not notify D.T. of this fact. D.T. indicated that his debit card was a Credit 
Union 1 VISA debit card (VISA debit card) bearing XXXXXXXXXXXX2851, expiration 
01/15, and that he did not give his VISA debit card to anyone else or give anyone permission to 
use it. The card is thus believed to have been stolen from D.T.'s vehicle at the time D.T. 
observed the vehicle break-in. D.T. further related that S.K.’s driver’s license had also been in 
his vehicle. That driver’s license was missing when searched for on 02-02-2012, indicating that 
it also was stolen at that fime: =l'llnow that a driver’s license is generally necessary to leave the 
State of Alaska by airplarie,'-joad' ! or ferry, due to established interstate (or international in the 
case of travel to/from Alaska via the Alaska-Canada Highway) travel requirements. 
Furthermore, due to Alaska’s unique geographic location, the difficulty of traveling by road 
through northern Canada in winter, and the lengthy periods generally associated with traveling 
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to/from Alaska by ferry, commercial airlines are the most common and popular mode of 
interstate travel to/from Alaska, especially during the winter. 

Ransom Note and Transfer of Funds to “Ransom Account” 

14. On 02-24-2012, at 19:56 AST, D.T. received the following text on his cell phone 
907-231-9835 from S.K.’s cell phone 907-884-8370 - “Conner park sign under pic of albert aint 
she purty”. J.K. (S.K.’s father) contacted law enforcement officers and relayed the information. 
At the request of APD Detectives, at approximately 20:18 AST, APD Patrol Officers arrived at 
Conner Park located on the southeast corner of Jewel Lake Road and International Airport Road 
in Anchorage, Alaska, J.K.and D.T. were already present. Attached to the park sign, below a 
flyer for a lost dog named “Albert,” was a ziploc bag which contained a folded piece of paper. 

15. On one side of the piece of paper, there was a photograph of S .K. with silver duct 
tape around her mouth and chin. She appeared to be wearing eye liner, and a light-colored, 
latex-gloved hand and lightly complected, muscular arm was holding S.K.'s hair. In the upper 
part of the photo was an Anchorage Daily Newspaper determined to be the issue released on 
Monday, February 13,2012. 

16. On the reverse side of the piece of paper was a ransom note which demanded 
$30,000. The note included the 16-digit card number of the debit card belonging to D.T., which 
he had reported stolen on the night of the kidnaping, as summarized above. This debit card 
number is correlated to a bank account number held by D.T. and S.K. The note demanded that 
$30,000.00 be deposited into that account and indicated that the writer of the note intended to 
withdraw money at regular intervals over the coming days, and in locations other than Alaska. 
Specifically, it said, “I may not use the card much in ak due to small pop but as I will be leaving 
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soon I will be using it all over.” The note further gave an indication that S .K. had been moved 
from Alaska, stating that “she did almost get away twice, once on tudor and once m the desert, 
must be losing my touch ” I know from research, training, and experience, and discussions with 
law enforcement officers familiar with Alaska that there are no areas in Alaska commonly 
referred to and known to be “deserts.” Many such areas do exist in Arizona, New Mexico and 
Texas. Subsequent analysis of the demand note by the FBI Laboratory revealed that it was typed 
with a typewriter that used a carbon ribbon, and that the aforementioned picture on the back of 

the demand note was printed with an inkjet printer. 

. 17. On 02-29-2012, at approximately 16:55 AST, J.K. contacted APD Detectives and 
told them he was withdrawing $5,000.00 from the reward account set up for S.K. at Denali 
Alaskan Federal Credit Union, and he intended to deposit it in the ransom fund, which was an 
account held by Credit Union 1. Pursuant to a State search warrant obtained by APD Detective 
Joseph Barth on 02-25-2012, investigators were informed that $5,000.00 was deposited in the 
Credit Union 1 account indicated on the ransom note, (the account attached to the Credit Union 
1 VISA debit card [VISA debit card] bearing XXXXXXXXXXXX2851 , expiration 01/15 issued 
to D.T).at 17:45 AST on 02-29-2012). 

Unauthorized use of Credit Union 1 VISA debit car d. 

18. On 02-29-2012 at 22:13 AST, an unknown person utilizing D.T.’s Credit Union 1 
debit card attempted to withdraw $600.00 in US Currency from the account indicated on the 
ransom note. The attempted withdrawal took place at the Automatic Teller Machine (ATM) 
located at the Alaska USA bank at 4000 Credit Union Drive in Anchorage, Alaska. Because the 
attempted amount was over the $500.00 daily limit, the withdrawal was declined. Surveillance 







video in the area of the ATM revealed a male dressed in a black hooded sweatshirt and black 
pants, operating a light-colored SUV, arrived in the parking lot of the Sea Galley restaurant 
across the street. After parking the SUV, the male exited and quickly walked across the street to 
the area of the Alaska USA ATM. The SUV was later determined by the FBI to be a silver 
Nissan Xterra of a model between the years 2005 and 2012. As noted below, police have now 
determined that KEYES' girlfriend owns a silver 2007 Nissan Xterra. 

19. On 02-29-2012 at 23:56 AST, $500.00 in US Currency was withdrawn from the 
ATM at the Denali Alaskan Federal Credit Union located at 3020 Minnesota Drive in 
Anchorage, Alaska. The debit card utilized to withdraw the money was the same Credit Union 1 
debit card issued to D.T. Surveillance video obtained of the area revealed this withdrawal was 
conducted by an unknown male with a muscular appearance wearing a dark-colored, possibly 
hooded, jacket with a.light-colored design or paint spatter on the left chest and front, and light- 
colored lettering, including possibly "CORPS" across the back shoulders; clear or light-colored 
glasses; a gray face mask; gray gloves; dark-colored pants; and light-colored shoes. 

20. During the course of the investigation, Detective Blanton and Officer Pierce of 
APD obtained surveillance footage from businesses surrounding the Alaska USA, which is 
located on Credit Union Drive in Anchorage, Alaska. Immediately before the withdrawal, a 
hidden surveillance camera located at the Sea Galley at 4101 Credit Union Drive in Anchorage, 
Alaska captured a similarly dressed male park in the extreme southwest comer of the Sea Galley 
parking lot driving a silver Nissan Xterra. From the surveillance video, the male appeared to 
exit the vehicle and walk westbound across the street to the Alaska USA and return a short while 
later. Both the male’s appearance and timing are commensurate with him being the person who 
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attempted to withdraw the money. 

21. On 03-01-2012 at approximately 00:28 AST, $500.00 in US currency was 
withdrawn from the ATM at the Alaska USA located at 7701 Debarr Road in Anchorage, 

Alaska. As with the prior two transactions, the debit card utilized to withdraw the money was 
the Credit Union 1 debit card issued to D.T. 

22. On 03-07-2012 at approximately 21:57 AST, $400.00 in US currency was 
withdrawn from the ATM at the Western Bank located at 200 West Rex Allen Road in Willcox, 
Arizona. The debit card utilized to withdraw the money was the Credit Union 1 debit card 
issued to D.T. Surveillance video on the ATM showed the individual using the debit card for 
the withdrawal was a white male dressed in a gray hooded jacket or sweatshirt, glasses, a gray 
face mask, gray gloves, dark-colored pants, and light-colored shoes, and appeared to be driving a 
late model white Ford Focus sedan. 

23. On 03-07-2012 at approximately 23:24 AST, there was an attempted $400.00 
withdrawal at the Western Bank located at 711 Main Street in Lordsburg, New Mexico, using 
D.T.’s Credit Union 1 debit card (the same card referenced in prior paragraphs.) The withdrawal 
was declined by the ATM as it would have put the debit card over the daily withdrawal limit. 

At 23:25 AST, at the same ATM, a balance inquiry was conducted on the account utilizing the 
debit card. The balance shown was $3,598.91. At 23:26 AST, $80.00 was withdrawn from the 
account utilizing the debit card. Surveillance video on the ATM showed the individual using the 
debit card wore similar clothing to the first ATM withdrawal in Arizona. 

24. On 3-9-2012 at approximately 23:23 AST, there was a $483.00 withdrawal made 
at an ATM at Houston Community Bank, 1515 FM 1960 Bypass East, Humble City, Texas. 





Initial review of the surveillance video from the ATM appeared to show that the individual using 
the debit card wore similar clothing to that worn during the two aforementioned ATM 
withdrawals in Arizona and New Mexico. 

25. On 03-11-2012 at approximately 23:47 AST, there was a $480.00 withdrawal at 
the People's State Bank located at 5850 Hwy 59 South, Shepherd, Texas using D.T.’s Credit 
Union 1 debit card (the same card referenced in prior paragraphs.) Surveillance video on the 
ATM showed the individual using the debit card wore similar clothing to the first ATM 
withdrawal in Arizona,' as well as the subsequent withdrawals in New Mexico and Texas. 

Stnp nf the White Ford Focus 

26. On 03/13/2012, at approximately 11:00 Central Time (CT), Texas Ranger Steven 
Rayburn, was notified by Texas Department of Public Safety (DPS) Highway Patrol Corporal 
Bryan Henry (Corporal Henry) that a white Ford Focus sedan bearing Texas license plate 
DH4N930 was observed parked at the Quality Inn & Suites (QIS), 4306 South First Street, 
Lufkin, Texas, which is a short drive from Shepherd, Texas. 

27. On 03/13/2012, at approximately 11:15 CT, Ranger Rayburn responded to the 
QIS, at which time FBI Agent Deb Gannoway conducted a walk-by and visual inspection of the 
white Ford Focus., Gannoway noted abar-code sticker on the driver's side back passenger 
window consistent with stickers applied to rental vehicles. She also noted numerous items of 
clothing, trash and other debris in plain sight within the vehicle, including what appeared to be a 
girl's or woman's pink item of clothing. Ranger Rayburn caused a Texas license plate database 
search to be conducted which revealed the white 2012 Ford Focus was registered to PV Holding 
Corporation, 9603 John Saunders Road, San Antonio, Texas. DPS Criminal Investigative 
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Division (CID) Lieutenant Mickey Hadnot (Lieutenant Hadnot) maintained surveillance on the 
Ford Focus. 

28. On 03/13/2012, at approximately 11:30 CT, Lieutenant Hadnot reported to 
Ranger Rayburn, that a white male adult exited room 215 of the QIS, placed some items into the 
trunk of the aforementioned white Ford Focus, and departed the scene alone, driving the white 
Ford Focus. FBI Agent Deb Gannoway had previously obtained from the QIS front desk 
manager an "in house list" of all occupants of the QIS on the night of 03/12/2012, which 
reflected room 215 was rented by ELIJAH KEYES for the time period 03/09/2012 through 
03/13/2012. 

29. On 03/13/2012, at approximately 11:45 CT,- Corporal Henry conducted a traffic 
stop on the white Ford Focus sedan based in part on FBI Agent Deb Gannoway’s suspicion that 
the vehicle was the same vehicle used in the Arizona, New Mexico, and Texas ATM 
withdrawals, as well as Corporal Henry's assessment that the driver of the vehicle was traveling 
in excess of the posted speed limit. Corporal Henry provided to FBI Agent Deb Gannoway 
Alaska Driver's License number 7268639, in the name of ISRAEL KEYES, which KEYES had 
provided to Corporal Henry. KEYES informed Corporal Henry, he flew from Anchorage, 

Alaska, to Las Vegas, Nevada, on 03/07/2012, and that he rented the white Ford Focus at the Las 
Vegas airport, driving to his present location over the course of the ensuing week. KEYES 
provided to law enforcement officers a copy of his car rental agreement, which corroborated his 
statement that he had rented the car at the Las Vegas, Nevada, airport on 03/07/2012. KEYES 
was unable to describe to law enforcement officers the route he drove from Nevada to Texas, but 
stated he was in Lufkin, Texas, to attend his sister's wedding in Wells, Texas. KEYES told 
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officers he "probably" paid for fuel throughout his travels from Nevada to Texas with cash. 
Ranger Rayburn observed that there was a pair of large white tennis shoes partially pushed under 
the driver's seat of the Ford Focus, which Ranger Rayburn could plainly see through the window. 
During questioning by FBI Agent Gannoway and Ranger Rayburn, KEYES became increasingly 
agitated and uncooperative, and he refused to allow Ranger Rayburn to inspect his wallet (which 
was in his pocket) or his vehicle. KEYES became unusually nervous and began to sweat 
profusely, in spite of the slightly cool weather and the tank top which he was wearing at the 
time. KEYES expressed that if he was going to be kept in the area for a longer period of time, 
he desired to call his brother (who has KEYES' daughter in a separate car) and notify him of 
same. Officers suggested KEYES make that call. A short time later, the 2012 Ford Focus was 
transported to and secured at the Lufkin, Texas, Police Department. 

30. Based on the aforementioned observations, including the fact that the rented Ford 
Focus matched the description of the vehicle utilized in the ATM withdrawals in Arizona, New 
Mexico and Texas, KEYES’ arrival in Las Vegas, Nevada, and his subsequent travel from 
Nevada to Texas very likely resulting in KEYES traveling through Arizona on or about 
03/07/2012 (the date of a $400.00 ATM withdrawal in Arizona) and New Mexico on or about 
03/08/2012 (the date of an $80.00 ATM withdrawal in New Mexico), KEYES' appearance 
closely matching the description of the white male adult observed in videos of the above- 
described ATM withdrawals, KEYES’ own admission that he lived in the Anchorage, Alaska, 
area, KEYES’ Alaska driver's license reflecting an Anchorage, Alaska, address, the white tennis 
shoes under the driver's seat matching the description of the shoes worn by the white male adult 
observed in the videos of the above-described ATM, as well as other observations. Corporal 
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Henry placed KEYES under arrest. Ranger Rayburn searched KEYES’ wallet, revealing a VISA 
ATM/Debit card bearing account number XXXXXXXXXXXX2851, expiration date 01/15, in 
the name of D.T. This card is linked to the “ransom account” identified above, from which the 
withdrawals and attempted withdrawals summarized above were made. The search of KEYES 
pursuant to his arrest also revealed an AT&T Pantech flip cellular phone, blue and silver in 
color, Model #P2000, S/N 110301023456. 

Discovery of KEYES’ White Chevrolet Truck 

31. APD Detectives discovered that ISRAEL KEYES listed a mailing address of 
3705 Arctic Blvd. #2891 in Anchorage, Alaska, on 07-18-2011, which is the Mail Cache. APD 
Detectives also discovered that KEYES listed a residential address of 2456 Spurr Lane in 
Anchorage, Alaska, as of 07-18-2011. 

32. On 03-13-2012 at approximately 10:30 AST, members of the APD Special 
Assignment Unit went to KEYES’ home address at 2456 Spun Lane in Anchorage, Alaska. No 
one answered repeated knocks on the door. Per APD Sergeant Redick, there were fresh tire 
impressions in the snow in the driveway of the address that appeared as if a vehicle had been 
parked there as recently as the morning of 03-13-2012. 

33. There was also a white Chevrolet pickup truck parked in the driveway of the 
address. The truck had a large toolbox in the bed and a ladder rack on top. The bolts securing 
those items were removable and appeared to have been recently added. The license plate on the 
truck was Alaska license plate FTC990, relating to a white 2004 Chevrolet Silverado, registered 
to ISRAEL KEYES at 2456 Spurr Lane in Anchorage, Alaska. The white Chevrolet truck 
appeared to match the vehicle appearing in the Home Depot surveillance video, as summarized 
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above. Further, Detectives eventually contacted KEYES’ girlfriend and discovered that she 
drives a 2007 Nissan Xterra, which matched the general description of the vehicle used by an 
individual who appeared to attempt to use the stolen debit card on 2-29-12, as summarized 
above. 

Discovery OF KEYES’ Computer Use and Use of Ya hoo Account 

34. KEYES' girlfriend, who also lives at his residence, was interviewed on 
approximately March 14,2012. She indicated KEYES was out of Alaska. She also indicated 
that KEYES owned a laptop computer and that his computer was not in the residence. 

35. Alaska Airlines provided travel records for KEYES pursuant to a Federal Grand 
Jury Subpoena that was issued to them on March 14,2012. In reviewing the returns for this 
subpoena, travel records were found showing KEYES and his young daughter traveled to 
Houston on February 2,-2012. KEYES was originally scheduled to return on February 14,2012 
but changed the ticket to return on February 17,2012. The ticket was booked online October 1, 
2011 and an email confirmation was sent on the same date. The return ticket was changed to 
February 17,2012 and an email confirmation was sent on 2/15/2012. The notes for this 
transaction indicate-the email confirmation was sent to an email address believed to belong to 
A.K., the mother of KEYES’ daughter. However, the tickets were booked using A.K’s credit 
card. A.K.does not reside in the state of Alaska and it is likely she had to forward the email 
confirmation to KEYES so that he would know the dates/times of travel. 

36. In reviewing the returns for this subpoena, travel records were also found showing 
KEYES and his young daughter traveled to Las Vegas on March 6, 2012 via Alaska Airlines. 
This ticket was booked online and he provided an email address with the reservation. The notes 
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section of the travel records indicated the email address provided was 
israelkeves@vahoo.com . The records also indicated an email confirmation was sent to 
Israel keves@.vahoo.com on March. 1,2012. 

Execution of Search Warrant and Discovery of Cellular Telephone Matching 
Description of Phone Belonging to S.K. and Other Cellular Telephones and Digital Media 
Devices 

37. On March 16,2012, law enforcement agents in Beaumont, Texas obtained a search 
warrant which authorized the search of the white Ford Focus driven by KEYES. Execution of 
that search warrant on March 17,2012 revealed numerous items, including a Samsung 
cellphone, black in color, slider type. Model# SCH-R631. Possible S/N 80015743 (this number 
is on the back of the phone but it does not indicate it as a S/N), which matched the description of 
S.K.’s cellular phone provided by S.K.’s boyfriend (per paragraph 9, S.K. is believed to have 
been carrying the phone when the kidnapping took place), a laptop computer; a DVD case; a 
Sony Cybershot Camera, silver in color, Model #DSC-S700, S/N 0522961; and a Sandisk M250 
MP3 Player, black in color, 2GB. The laptop computer, Samsung cellular phone, Sony 
Cybershot Camera, and Sandisk M250 MP3 player were all seized pursuant to the search of the 
vehicle. The DVD case was initially not seized, but were rather returned to KEYES mother, 
HEIDI KEYES. 

38. In my training and experience, I know that photos from digital cameras and 
cellular phones are frequently downloaded to. computers and electronic tablets, and then printed 
or stored on media devices. I also know that cellular phones, computers, electronic tablets and 
similar devices are frequently used to arrange travel and hotel reservations, rent vehicles, and 


16 






conduct other personal business related to traveling. I also know that computers and cellular 
phones can be used to connect to the internet, which can be used to locate banks, ATM’s, hotels, 
maps, send email, draft documents, and communicate with others. I also know that storage 
devices for electronic information, or “thumb” drives, are often used to store such information 
for later use by computers, cellular phones and other media devices. I know that electronic 
records of all such uses of computers and similar electronic devices are retained within those 
devices and may be retrieved by forensic technicians. 

Interview of KEYES 

39. In an interview with defense counsel present on March 17, 2012, KEYES admitted 
to .using D.T.’s debit card at locations throughout the southwest United States. He also claimed 
that he received the debit card and the cellular telephone matching the description of S.K.’s 
telephone together in a plastic bag from an anonymous person, who left the plastic bag in his 
vehicle. Based on my training and experience, it appears very likely that the specifics of 
KEYES’ account of the origin of his possession of the phone and debit card is not truthful; 
however, his admission that the phone and debit card are associated with each other associates 
both items with S.K., and confirms the identification of the phone as belonging to S.K. During 
the interview, KEYES also indicated that a Micro SD Card belonging to the phone matching the 
description of S.K.’s phone was located within the DVD case that had been present in the white 
Ford Focus and had been returned to KEYES mother, HEIDI KEYES, following the search of 
that vehicle. 

Consensual Seizure of Lexar 4GB Micro SD card and LG Cellular Telephone 
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40. Following the interview with KEYES, law enforcement officers visited KEYES 
mother, HEIDI KEYES. During this visit, officers were informed that KEYES’ daughter, L.K., 
who had been intermittently traveling with KEYES from March 6,2012 through March 13, 

2012, was in possession of a black flip-out LG Cellular Telephone S/N 104CYHE2202705. 

L.K. indicated that she had possessed this cellular phone while traveling with KEYES and that 
he had access to it throughout their intermittent travels. Officers requested that HEIDI KEYES, 
who was supervising L.K., consent to provide the black flip-out LG Cellular Telephone S/N 
104CYHE2202705. HEIDI KEYES consented to provide the phone, and officers subsequently 
seized it. Officers also requested that she allow officers to examine the DVD case found in the 
white Ford Focus and released to her, which KEYES had indicated in his interview contained a 
Micro SD chip for the cellular phone belonging to S.K. HEIDI KEYES consented to allow an 
examination of the DVD case. Pursuant to that examination, officers discovered a Lexar 4GB 
Micro SD card that appears to fit the cellular telephone belonging to S.K. HEIDI KEYES then 
consented to provide the SD Card to officers. Officers subsequently seized the SD card. 

40. The Devices listed at paragraph 2, above, are currently in the lawful possession of 
the FBI. The Devices came into the FBI possession as outlined above. Although the FBI might 
already have the lawful authority to examine the Devices, 1 seek this additional warrant out of an 
abundance of caution to be certain that an examination of the Devices will comply with the 
Fourth Amendment and other applicable laws. 

41. The Devices are currently in storage at FBI Anchorage Station, Anchorage, Alaska. 
In my training and experience, I know that the Devices have been stored in a manner in which 
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their contents are, to the extent material to this investigation, in substantially the same state as 
they were when the Devices first came into the possession of the government. 

TECHNICAL TERMS 

42. Based on my training, my experience, and information provided to me by other 
law enforcement personnel, I use the following technical terms to convey the following 
meanings: 

a. ' “Storage medium”: A storage medium is any physical object upon 

which data can be stored, including a cellular telephone’s flash 
memory or other data storage components, such as a SIM card. 

b. “Wireless telephone”: A wireless telephone (or mobile telephone, 
or cellular telephone) is a handheld wireless device used for voice, 
and data communication through radio signals. These telephones 
send signals through networks of transmitter/receivers, enabling 
communication with other wireless telephones or traditional “land 
line” telephones. A wireless telephone usually contains a “call 
log,” which records the telephone number, date, and time of calls 
made to and from the phone. In addition to enabling voice 
communications, wireless telephones offer a broad range of 
capabilities. These capabilities include: storing names and phone 
numbers in electronic “address books”; sending, receiving, and 
storing text messages and e-mail; taking, sending, receiving, and 
storing still photographs and moving video; storing and playing 
back audio files; storing dates, appointments, and other 
information on personal calendars; and accessing and 
downloading information from the Internet. Wireless telephones 
may also include global positioning system (“GPS”) technology 
for determining the.location of the device. 

c. “Computer”: Pursuant to 18 U.S.C. § 1030(e)(1), a computer is 
“an electronic, magnetic, optical, electrochemical, or other high 
speed data processing device performing logical or storage 
functions, and includes any data storage facility or 
communications facility directly related to or operating in 
conjunction with such device.” 





IP Address: An Internet Protocol address (or simply “IP Address”) 
is a unique numeric address used by computers on the Internet. . 
An IP address is a series of four numbers, each in the range 0-255, 
separated by periods (e.g., 121.56.97.178). Every computer 
attached to the Internet must be assigned an IP address so that 
Internet traffic sent from and directed to that compuiter may be 
directed properly from its source to its destination. Most Internet 
service providers control a range of IP addresses. Some computers 
have static- that is, long-term - IP addresses, while other 
computers have dynamic - that is, frequently changed - IP 
addresses. 

Internet: The Internet is a global network of computers and othe . 
electronic devices that communicate with each other. Due to the 
structure of the internet, connections between devices on the 
internet often cross state and international borders, even when the 
devices communicating with each other are in the same state. 


Portable media player: A portable media player (or “MP3 Player” 
or iPod) is a handheld digital storage device designed primarily to 
store and play audio, video, or photographic files. However, a 
portable media player can also store other digital data. Some 
portable media players can use removable storage media. 
Removable storage media include various types of flash memory 
cards or miniature hard drives. This removable 
storage media can also store any digital data. Depending on the 
model, a portable media player may have the ability to store very 
large amounts of electronic data and may offer additional features 
such as a calendar, contact list, clock, or games. 

Digital camera: A digital camera is a camera that records pictures 
as digital picture files, rather than by using photographic film. 
Digital cameras use a variety of fixed and removable storage 
media to store their recorded images. Images can usually be 
retrieved by connecting the camera to a computer or by connecting 
the removable storage medium to a separate reader. Removable 
storage media include various types of flash memory cards, SD 
cards or miniature hard drives. Most digital cameras also include 
a screen for viewing the stored images. This storage media can 





contain any digital data, including data unrelated to photographs or 
videos. 

h. Secure Digital (SD) Card: A Secure Digital (“SD”) Card is a 
removable computer memory chip for use in portable devices, 
including cellular phones, MP3 players and digital cameras. SD 
cards store digital data in a format usable by a particular electronic 
• device. 

43 Based on my training, experience, and research, I know that the Target 
Devices have capabilities that allow them to serve as a wireless telephone, digital camera, 
memory storage, and may also function as a computer and internet browser. In my training and 
experience, examining data stored on devices of this type can uncover, among other things, 
evidence that reveals or suggests who possessed or used the device. 

ELECTRONIC STORAGE AND FORENSIC ANALYSIS 

44. The applied-for warrant would authorize the forensic examination of the 
Target Devices for the purpose of identifying and seizing the electronically stored information 
particularly described in Attachment B in accordance with Federal Criminal Procedure Rule 
41(e)(2)(B) (“Warrant Seeking Electronically Stored Information”). 

45. Forensic evidence'. As further described in Attachment B, this application 
seeks permission to locate not only electronically stored information that might serve as direct 
evidence of the crimes described on the warrant, but also forensic evidence that establishes how 
the Target Devices were used, the purpose of their use, who used them, and when. There is 
probable cause to believe that this forensic electronic evidence more likely than not is stored in 
the Target Devices because: 


a. Data on a storage medium can provide evidence of information 

that was once on the storage medium but has since been deleted or 
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edited, or of a deleted portion of the information. 

Forensic evidence stored within the Target Devices can also 
indicate who has used or controlled the Target Devices. This 
“user attribution” evidence is analogous to the search for “indicia 
of occupancy” while executing a search warrant at a residence. 

A person with appropriate familiarity with how the Target Devices 
works may, after examining this forensic evidence in its proper 
context, be able to draw conclusions about how electronic devices 
were used, the purpose of their use, who used them, and when. 

The process of identifying the exact electronically stored 
information on a storage medium that are necessary to draw an 
accurate conclusion is a dynamic process. Electronic evidence is 
not always data that can be merely reviewed by a review team and 
passed along to investigators. Whether data stored on a cellular 
telephone is evidence may depend on other information stored on 
the cellular telephone and the application of knowledge about how 
a cellular telephone operates. Therefore, contextual information 
necessary to understand other evidence also falls within the scope 
of the warrant. 

Further, in finding evidence of how the Target Devices was used, 
the purpose of its use, who used it, and when, sometimes it is 
necessary to establish that a particular thing is not present on a 




storage medium. 

f. Based on my knowledge, training and experience, I know that 

electronic devices can store information for long periods of time. 
Similarly, things that have been viewed via the internet are 
typically stored for some period of time on the device. This 
information can sometimes be recovered with forensics tools. 

46. Nature of examination: Based on the foregoing, and consistent with Rule 
41 (e)(2)(B), the warrant I am applying for would permit the examination of the Target Devices 
consistent with the warrant. The examination may require authorities to employ techniques, 
including but not limited to computer-assisted scans of the Target Devices’ entire storage 
medium, that might expose many parts of the devices to human inspection in order to determine 
whether it is evidence described by the warrant 

47. Manner of execution : Because this warrant seeks only permission to 
examine a cellular telephone already in law enforcement’s possession, the execution of this 
warrant does not involve the physical intrusion onto a premises. Consequently, I submit there is 
reasonable cause for the Court to authorize execution of the warrant at any time in the day or 
night. 

48. Forensic image retention: I hereby request judicial authorization to retain 
full copy of the Devices’ storage media after the review is complete (to the extent that this 
warrant dps^ npl ah eddy authorize me to retain that storage media as seized forfeitable property) 
and until fbprthHr Qidei of the Court. That judicial authorization is justified in this case in part 


because: 




Should the execution of the warrant uncover data that may later 
need to be introduced into evidence during a trial or other 
proceeding, the authenticity and the integrity of the evidence and 
the government’s forensic methodology may be contested issues. 
Retaining copies of seized storage media can be required to prove 
these facts. 

Returning the original storage medium to its owner will not allow 
for the preservation of that evidence. Even routine use of a 
cellular telephone may forever change the data it contains or 
eliminate data stored on it. 

Because the investigation is not yet complete, it is not possible to 
predict all possible defendants against whom evidence found on 
the storage medium might be used. That evidence might be used 
against persons who have no possessory interest in the storage 
media, or against persons yet unknown. Those defendants might 
be entitled to a copy of the complete storage media in discovery. 
Retention of the entire content of the storage medium assures that 
it will be available to all parties, including those known now and 
those later identified. 

The act of destroying or returning a Device could create an 
opportunity for a defendant to claim, falsely, that the destroyed or 
returned Devices contained evidence favorable to him. 




Maintaining a copy of the Devices’storage medium would permit 
the government, through an additional warrant if necessary, to 
investigate such a claim. 

e. Similarly, should a defendant suggest an explanation for the 

presence of evidence on a storage medium, it may be necessary to 
investigate such an explanation by, among other things, 
re-examining the storage medium with that defense in mind. This 
may require an additional examination of the storage medium for 
evidence that is described in Attachment B but was not properly 
identified and segregated previously. 

CONCLUSION 

49. Based on my training and experience, and the facts as set forth in this affidavit, 
there is probable cause to believe that on the following Devices, as set forth in paragraph 2 
above: 

a BLUE AND SILVER AT&T PANTECHCELLULAR PHONE, MODEL #P2000, S/N 
110301023456, further identified in Attachment A, for the information identified in Attachment 
B. 

There exists fruits, evidence, and instrumentalities of violations of Title 18, 
United States Code (USC), Section* 1029(a)(5) (Fraud and Related Activity in Connection with 
Access Devices )(FRACAD); Title 18, United States Code, Section 1201 (Kidnapping); and 
Title 18, United States Code, Section 1202(b) (Ransom Money). 

50. This Court has jurisdiction to issue the requested warrant because it is “a court of 




competent jurisdiction” as defined by 18 U.S.C. § 2711. 18 U.S.C. §§ 2703(a), (b)(1)(A) & 
(c)(1)(A). Specifically, the Court is “a district court of the United States ... that - has 
jurisdiction over the offense being investigated.” 18 U.S.C. § 2711(3)(A)(I). 

51. The investigation of this case is ongoing and disclosure of the issuance of the 
search warrant could result in destruction of evidence and could also impact officer, witness and 
victim safety. Accordingly, pursuant to the case law outlined in the government’s motion to 
seal, I respectfully request that the search warrant, search warrant affidavit, attachments, and 
returns be sealed. 


Fm-tw a -ex*-* -naught. 

- (si Signature Redacted -- 

Special Agent Jolene Goeden 
Federal Bureau of Investigation 


SUBSCRIBED, and SWORN to before r 
, 2012 . 

- sr $>/ /s/John D. Roberts, USMJ , 

.»i_2Signature Redacted _ 

itJUIUTyj J.vo 

-i^/^Dnited States ^papsjtfca 





IN THE MATTER OF THE SEARCH OF BLUE AND SILVER AT&T 
PANTECHCELLULAR PHONE, MODEL #P2000, S/N 110301023456, CURRENTLY 
LOCATED AT FBI ANCHORAGE NON-DRLBS EVIDENCE LOCKER 


KAREN L. LOEFFLER 
United States Attorney 


CRAIG M. WARNER 

Assistant U.S. Attorney 

Federal Building & U.S. Courthouse 

222 West Seventh Avenue, #9, Room 253 

Anchorage, Alaska 99513-7567 

Phone: (907) 271-5071 

Fax: (907) 271-1500 

E-mail: craig.warner@usdoj.gov 


IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF ALASKA 


In the Matter of the Search of: 

BLUE AND SILVER AT&T 
PANTECH CELLULAR PHONE, 
MODEL #P2000, S/N 110301023456 


) Case No.3:12-MJ-0013 7-JDR 

) 

) MOTION TO SEAL SEARCH 
) WARRANT, APPLICATION, 

) AFFIDAVIT FOR SEARCH 
) WARRANT, ATTACHMENTS, 
) AND RETURN 
) 

) FILED UNDER SEAL 


COMES NOW the United States of America, by and through undersigned 


counsel and hereby moves for an order sealing the Search Warrant, Application 
and Affidavit and Returns for the search warrant issued in the above-captioned 


matter until further order of this Court. 

The government makes this motion to protect the investigative integrity of 
the present case. The investigation of this case is ongoing and disclosure of the 






issuance of the search warrant could result in destruction of evidence and could 


also impact officer, witness and victim safety. 

Historically, courts have recognized a “general right to inspect and copy 
public records and documents, including judicial records and documents.” 
Kamakana v. City and Countv of Honolulu. 447 F.3d 1172, 1178 (9th Cir. 2006) 
citing Nixon v. Warner Communications. Inc.. 435 U.S. 589, 597 & n.7 (1978). 
Nonetheless, access to judicial records is not absolute. A narrow range of 
documents is not subject to the right of public access at all because the records 
have “traditionally been kept secret for important policy reasons.” Id. citing 
Times Mirror Co. V. United States. 873 F.2d 1210, 1219 (9th Cir. 1989). Ninth 
Circuit case law has identified two categories of documents that fall into this 
category: grand jury transcripts and warrant materials in the midst of a pre¬ 
indictment investigation. Id. Parties seeking to seal a judicial record not 
traditionally kept secret must provide compelling reasons to the court for doing so. 
Id. In general, “compelling reasons” are those sufficient to outweigh the public’s 
interest in disclosure. Id. at 1179. 

Based on the foregoing, the government respectfully requests this Court 

enter the attached proposed Order sealing said search warrant, Application and 
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CELLULAR PHONE, MODEL #P2000, S/N 110301023456 CURRENTLY LOCATED AT 
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Affidavit for Search Warrant, the Returns and this Motion and Order until said 
time as the government has time to review the information contained therein and 
act upon. 

RESPECTFULLY SUBMITTED this 22th day of March, 2012, in 
Anchorage, Alaska. 


KARpNL. LOEFFLER 

c Isl Signature Redacted Is! Signature Redacted 
- vvaiU .C.l- 

Assistant U.S. Attorney 

Federal Building & U.S. Courthouse 

222 West Seventh Avenue, #9, Room 253 

Anchorage, Alaska 99513 

Phone: (907) 271-5071 

Fax: (907) 271-1500 

E-mail: craig.wamer@usdoj.gov 


IN THE MATTER OF THE SEARCH OF BLUE AND SILVER AT&T PANTECH 
CELLULAR PHONE, MODEL #P2000, S/N 110301023456 CURRENTLY LOCATED AT 
FBI ANCHORAGE NON-DRUG EVIDENCE LOCKER 
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IN THE UNITED STATES DISTRICT COURT 


FOR THE DISTRICT OF ALASKA 


In the Matter of the Search of: 

BLUE AND SILVER AT&T 
PANTECH CELLULAR PHONE, 
MODEL #P2000, S/N 110301023456 


) Case No. 3:12-MJ-00137-JDR 

) 

) ORDER GRANTING MOTION 
) TO SEAL SEARCH WARRANT, 
) APPLICATION, AFFIDAVIT 
) FOR SEARCH WARRANT, 

) ATTACHMENTS AND 
) RETURN 
) 

) FILED UNDER SEAL 


The United States requests that the Search Warrant, Application, Affidavit, 
Attachments and the Return filed in the above-captioned case be sealed. 

This Court finds that the need for secrecy to protect the ongoing 
investigation and potential witnesses outweighs the public’s right to inspect and 
copy judicial records and documents. 

IT IS HEREBY ORDERED that: 

The Search Warrant, Application, Affidavit and Attachments filed in the 
above-captioned case, and the Return to be filed, be sealed until further order of 
this Court. 


Further, the United States Attorney’s Office is directed to notify the Court 

/ 


// 




as soon as the need for secrecy passes by filing a motion to unseal records. 


DATED this 22nd day of March, 2012, at Anchor age,^Alaska.. 


/s/John D. Roberts, USM J */ 
^.Signature Redacted 

v JQfLN D. ROSJEETS^;- - 


s>ignaiure 

\jQHN I 

United States Magistrate-Judge • 
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4,0 93 (Rev. 12/03) Search Warrant 


United States District Court 

District of _ Alaska 


In the Matter of the Search of 

(Name, address or brief descriplion of person or properly [o be searched) 

SEARCH WARRANT 

Lexar4GB Micro Secure Digital (SD) card 


Case Number: 3:12-mj-000138-JDR 


TO: _ S/A Jolene Goeden, FBI _and any Authorized Officer of the United States 

Affidavits) having been made before me by _ S/A Jolene Goeden, FBI _who has reason to believe 

Affiant 

that dO on person of, or 0Qo n the premises known as (name, description and/or location) 

See Attachment A, which is incorporated by reference, 


in the ___District of _ Alaska _there is now 

concealed a certain person or property, namely (describe the person or property) 

See Attachment B, which is incorporated by reference. 


I am satisfied that the affidavit(s) and any record testimony establish probable cause to believe that the person or property so described 
is now concealed on the person or premises above-described and establish grounds for the issuance of this warrant. 

YOU ARE HEREBY COMMANDED to search on or before _ . 4/1/2012 _ 

Dale 

(not to exceed 10 days) the person or place named above for the person or property specified, serving this warrant and making the 
search 0 in the daytime — 6:00 AM to 10:00 P.M. □ at anytime in the day or night as 1 find reasonable cause has been 
established and if the person or property be found there to seize same, leaving a copy of this warrant and receipt for the person 
or property taken, and prepare a written inventory of the person or property seized and promptly return this warrant to 

_ X RalafcfhS _as required by law. 

U.S. Magistrate Judge (Rule 41(f)(4)) 


MbrU. Zq 1 fit at 

Dare and Time issued ‘ ( 

JOHN D. ROBERTS 

U.S. MAGISTRATE JUDGE 






' ,J /John D - Roberts, USMJ 

^Signature Redacted 






[Rev. 12/03) Search Warrant (Reverse) 


RETURN Case Number: 3:12-mj-000138-JDR 


DATE WARRANT RECEIVED DATE AND TIME WARRANT EXECUTED COPY OF WARRANT AND RECEIPT 

3(Z2.('ZOl'2- _ I 3/2z( < 20rz.e,fc>:00jS*Yi 1 t\frrwixr~JaU , 

INVENTORY MADE IN THE PRESENCE OF ‘' 


INVENTORY OF PERSON OR PROPERTY TAKEN PURSUANT TO THE WAKKAN i > 

L &Xojt ti&E fAi'cvO CSJ^ 


CERTIFICATION 


I swear that this inventory is a txue and detailed account of the person or property taken by 

Isl Signature Redacted 


■fi&l 

Subscribed, swom to, and returned before me this date. 

/s/Scott A. Oravec, USMJ 
_ Signature Redacted - 





ATTACHMENT A 




The property to be searched is a Lexar 4GB Micro Secure Digital (SD) Card, currently 
located at the FBI building at 101 E. 6 th Ave., Anchorage, Alaska, in the non-drug evidence 







ATTACHMENT B 


All records and information on the Target Device identified in Attachment A that relate to 
violations of Title 18, United States Code (USC), Section 1029(a)(5) (Fraud and Related Activity 
in Connection with Access Devices )(FRACAD); Title 18, United States Code, Section 1201 
(Kidnapping); and Title 18, United States Code, Section 1202(b) (Ransom Money), and involve 
ISRAEL KEYES since October 1, 2011, including: 


1. Evidence of who used, owned, or controlled the Target Device, including logs, 
registry entries, configuration files, saved usernames and passwords, documents - 
including but not limited to travel records, banking or other financial records, 
records indicating connection or interactions between KEYES and S.K. or 
surveillance of S.K, by KEYES, maps, driving or other geographic directions, 
Internet browser history and cache, user profiles, email, email contacts, chat logs, 
instant messages, photographs, and correspondence. 

2. Evidence of the times the Target Device was used. 

3. Passwords, encryption keys, and other access devices that may be necessary to 
access the Target Device . 

4. Evidence of the Target Device contacting or communicating with cellular 
phones or electronic devices, including text messages, application data, calender 
entries, notes, call records, contact or address book entries, photos, location 
information, and Internet browser history/cache; or evidence of assisting or 
recording memory of a cellular telephone conducting these same activities. 

5. Evidence of audio or video recordings. 

6. Contextual information necessary to understand the evidence described in this 

attachment. 

As used above, the terms "records” and “information” include all of the foregoing items 
of evidence in whatever form and by whatever means they may have been created or stored, 
including any form of computer or electronic storage. 






AO 106 (Rev. 04/!0) Application for a Search Warrant 


United States District Court 

for the 

District of Alaska 


In the Matter of the Search of ) 

(Briefly describe the property to be searched ) 

or identify the person by name and address) \ Case No. 3:12-mj-000138-JDR 

Lexar 4GB Micro Secure Digital (SD) card ) 


APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that 1 have reason to believe that on the following person or property (identify the person or describe the 

is incorporated herein by reference 


located in the District of_ Alaska _, there is now concealed (identify the 

person or describe the property to be seized)'. 

See Attachment B, which is incorporated herein by reference 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
l?f evidence of a crime; 

O' contraband, fruits of crime, or other items illegally possessed; 
gf property designed for use, intended for use, or used in committing a crime; 
O a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section 
18 U.S.C. 1029(a)(5) 
18U.S.C. 1201 
18 U.S.C. 1202(b) 


Access Device Fraud 
Kidnapping 
Ransom Money 


Offense Description 


The application is based on these facts: . 

See Attached Affidavit, which is incorporated herein by reference 


gf Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days:_) is requested 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 

^ isl Signature Redacted ^_ 

,, . . . ....are 

_ Jolene Goeden, FBI Special Agent _ 

Printed name and title 


Sworn to before me and signed in my presence. 

Date: 03/22/2012 

City and state: Anchorage, Alaska _ 


/s/John D. Roberts, USWU 
-'Signature Redacted 

Judge 's-signqtu, 


Ql Roberts,-.Magistrate Judge 


Printed name and title 









ATTACHMENT B 


» 




All records and information on the Target Device identified in Attachment A that relate to 
violations of Title 18, United States Code (USC), Section 1029(a)(5) (Fraud and Related Activity 
in Connection with Access Devices )(FRACAD); Title 18, United States Code, Section 1201 
(Kidnapping); and Title 18, United States Code, Section 1202(b) (Ransom Money), and involve 
ISRAEL KEYES since October 1,2011, including: 


Evidence of who used, owned, or controlled the Target Device, including logs, 
registry entries, configuration files, saved usernames and passwords, documents - 
including but not limited to travel records, banking or other financial records, 
records indicating connection or interactions between KEYES and S.K. or 
surveillance of S.K, by KEYES, maps, driving or other geographic directions, 
Internet browser history and cache, user profiles, email, email contacts, chat logs, 
instant messages, photographs, and correspondence. 


2. 

3. 


4. 


Evidence of the times the Target Device was used. 

Passwords, encryption keys, and other access devices that may be necessary to 
access the Target Device . 

Evidence of the Target Device contacting or communicating with cellular 
phones or electronic devices, including text messages, application data calender 
entries, notes, call records, contact or address book entries, photos, location 
information, and Internet browser history/cache; or evidence of assisting or 
recording memory of a cellular telephone conducting these same activities. 


5. Evidence of audio or video recordings. 

6. Contextual information necessary to understand the evidence described in this 
attachment. 


As used above, the terms “records” and “information” include all of the foregoing items 
of evidence in whatever form and by whatever means they may have been created or store , 
including any form of computer or electronic storage. 






UNITED STATES DISTRICT COURT 
THE DISTRICT OF ALASKA 


) 

IN THE MATTER OF THE SEARCH OF ) Case No. 3:12-mj-G0138-JDR 

) 

LEXAR 4GB MICRO SD CARD ) 

) 

) 

) 

) 

__J 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 

I, Jolene Goeden, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 

1. I am a Special Agent of the Federal Bureau of Investigation (FBI). I have been a 
Special Agent of the FBI since April 2004. I am charged with the duty of investigating violations 
of the laws of the United States, collecting evidence in cases in which the United States is or may 
be a party in interest, and performing other duties imposed by law. I have been assigned to 
investigate most criminal matters within the jurisdiction of the FBI, including kidnapping 
matters, fraud matters and other white collar crime. 

2. I make this affidavit in support of an application under Rule 41 of the Federal Rules of 
Criminal Procedure for a warrant to search five electronic items seized during a common set of 
searches and pursuant to a common set of circumstances, as outlined below : 

LEXAR 4GB MICRO SD CARD, further identified in Attachment. A, for the 


information identified in Attachment B. 







This item is currently located at FBI Anchorage at 101 East Sixth Avenue, Anchorage, 
Alaska, in the secure, non-drug evidence vault. 

3. As set forth herein, there is probable cause to believe that in the property to be searched 
there exists evidence of a crime, contraband, fruits of a crimes, or other items illegally possessed 
in violation of Title 18, United States Code (USC), Section 1029(a)(5) (Fraud and Related 
Activity in Connection with Access Devices )(FRACAD); Title 18, United States Code, Section 
1201 (Kidnapping); and Title 18, United States Code, Section 1202(b) (Ransom Money), as 
further described in Attachment A. 


RELEVANT STATUTES 

4. The Target Device contains evidence of and is an instrumentality used for 
violations of Title 18, USC, Section 1029(a)(5), Fraud and Related Activity in Connection with 
Access Devices, which provides that: 

Whoever, knowingly and with intent to defraud effects transactions with 1 or more access 
devices issued to another person or persons, to receive payment or any other things of 
value during any 1-year period that aggregate value of which is equal to or greater than 
$ 1 , 000 ; 

and Title 18, United States Code, Section 1201 (Kidnaping), which provides that: 

Whoever unlawfully seizes, confines, inveigles, decoys, kidnaps, abducts, or carries away 
and holds for ransom or reward or otherwise any person, except in the case of a minor by 
the parent thereof, when the person is willfully transported in interstate or foreign 
commerce, regardless of whether the person was alive when transported in interstate or 
foreign commerce or uses the mail or any means, facility, or instrumentality of interstate 
or foreign commerce in committing or in furtherance of the commission of the offense; 

and Title 18, United States Code, Section 1202(b) (Ransom Money), which provides that:. 

Whoever receives, possesses, or disposes of any money or other property, or any portion 
thereof, which has at any time been delivered as ransom or reward in connection with a 
violation of section 1201 of this title, knowing the same to be money or property which 
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has been at any time delivered as such ransom or reward. 


6. The applied for warrant would authorize the forensic examination of the devices listed 
above in paragraph 2, and further identified in Attachment A, for the purpose of identifying 
electronically stored data particularly described in Attachment B. 

PROBABLE CAUSE 

7. The information contained below is from my personal knowledge and experience, 
information provided to me by other law enforcement personnel, or from those specific sources 
as set forth. Since this affidavit is being submitted for the limited purpose of seeking 
authorization to search the Devices listed in paragraph 2 above, I have not included each and 
every fact known to me regarding this investigation. I have set forth only the facts that I believe 
are necessary to establish a foundation to support the aforementioned request for a search 
warrant. 

Abduction of S.K. 

8. On 2-2-12 at about 12:39 Alaska Standard Time (AST), Duncan, the owner of the 
Common Ground Coffee stand at 630 E. Tudor, Anchorage, Alaska, contacted APD dispatch. 
Duncan was calling from Oregon, where he was vacationing. He reported that while viewing his 
internet-based security system he saw one of his employees, 18-year-old S.K., appear to be 
abducted. Duncan said he was contacted by S.K.’s father (J.K.) and boyfriend (D.T.), who had 
been unable to locate her. This contact prompted Duncan to review his security video which 
showed an unknown man climb through the window of the coffee stand at about 20:00 AST on 
2-1-12 while S.K. was working. The video appears to show S.K. retreating a short distance and 





• # 


raising her hands in an apparent sign of submission to the man who subsequently climbed into 
the coffee stand, robbed S.K. and escorted her away from the scene. The abductor climbed 
through the window into the coffee stand without any significant difficulty. He appeared to be 
significantly taller than S.K., who is 5'4" tall, but due to the limited lighting and quality of the 
video, a more accurate estimate of his height has not been made. The robber/abductor appeared 
to have a medium to large build and athletic movements. 

9. At the time of her abduction, S.K, was wearing a dark-colored jacket, a green 
shirt with light-colored stripes on the sleeves, a thin dark-colored bracelet, dark-colored pants, 
and dark-colored shoes. At the time of her abduction, S.K. was also believed to be in possession 
of a carabineer with three keys and possibly a white lanyard, a medium-to-large size leopard 
print purse, and a black cellular telephone with sliding keyboard. S.K. is a white female adult, 
approximately 5'4" tall, 150 pounds, 18 years old, with shoulder-length brown hair and brown 
eyes. 

10. Video surveillance appeared to show S.K.'s robber/abductor wearing a dark- 
colored, possibly hooded, jacket, dark-colored glasses, a dark-colored face mask, dark-colored 
gloves, dark-colored pants; and dark-colored shoes. He appeared to be carrying a white coffee 
cup and a dark-colored bag. Although to date no weapon has been conclusively identified m the 
surveillance videos that captured this robbery/abduction, the scene was generally poorly lit and 
the robber/abductor was not always fully visible. Furthermore, S.K.'s reaction appeared to be 
consistent with someone who was confronted or threatened with a weapon. In addition, during 
separate subsequent interviews, both S.K.'s father and boyfriend adamantly indicated that S.K. 
was very strong-willed and would not have complied with a robber or abductor's demands. 
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unless she had been threatened with a weapon. 

11. Surveillance video from a nearby Home Depot at approximately 19:54 AST on 2- 
1-12 showed a white Chevrolet extended cab truck roll through the Home Depot parking lot and 
park just east of an International House of Pancakes. From a distance, the surveillance showed 
an individual with a black garment and hat get out of the truck and walk westbound through the 
parking lot towards Denali St., cross it, get on the sidewalk, walk southbound on Denali St. to 
Tudor Rd., cross Tudor Rd. at the intersection, and, finally, exit the frame. The individual’s 
travel was in the direction of the Common Ground Coffee stand, from which S.K. was abducted. 
One minute later, the video surveillance footage from Common Ground Coffee stand showed the 
individual who abducted S.K. approach from the direction of the man in the Home Depot video. 
Approximately two minutes after S.K. and her abductor exited the frame of the Common 
Ground Coffee stand video footage, two persons appearing to match S.K. and her abductor again 
entered the frame of the Home Depot video footage, this time walking back towards the location 
where the white Chevrolet truck was originally parked.' The Home Depot video then showed the 
two people approach the passenger side door of the Chevrolet truck. It then showed the person 
who appeared to be S.K. enter the passenger side of truck. The other individual then walked 
around truck, entered the driver’s side, and drove out of the surveillance video’s frame. As 
described below, police have now identified KEYES’ residence and located a white Chevrolet 
truck registered to him at that residence. This white Chevrolet truck belonging to KEYES 
appears to match the vehicle in the Home Depot surveillance footage, although KEYES’ truck 
has several toolboxes and a ladder rack fastened with removable bolts to the truck bed, and these 
items do not appear on the truck in the Home Depot video. 
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12. During an interview on 02-02-2012, D.T. (S.K.’s boyfriend) said he went to the 
coffee stand on 2-1-12 at about 20:33 AST to give her a ride home but the stand appeared to be 
closed and she was not there. D.T. further reported to law enforcement that on 02/02/2012, at 
approximately 03:00 AST, he observed an unknown male adult wearing a ski mask and dark 
clothing going through the vehicle he shared with S.K. D.T. did not alert authorities to the 
burglary of the vehicle at that time. 

13. When D.T. was asked where his ATM debit card was by APD Detectives several 
days after the abduction, he indicated he had left it in the vehicle he shared with S.K. This 
vehicle had been seized by APD on 02-02-2012 and searched pursuant to a State of Alaska 
search warrant. The debit card referenced above was not located during the search; however law 
enforcement did not notify D.T. of this fact. D.T. indicated that his debit card was a Credit 
Union 1 VISA debit card (VISA debit card) bearing XXXXXXXXXXXX2851, expiration 
01/15, and that he did not give his VISA debit card to anyone else or give anyone permission to 
use it. The card is thus believed to have been stolen from D.T.'s vehicle at the time D.T. 
observed the vehicle break-in. D.T. further related that S.K.’s driver’s license had also been in 
his vehicle. That driver’s license was missing when searched for on 02-02-2012, indicating that 
it also was stolen at that time, I know that a driver’s license is generally necessary to leave the 
State of Alaska by airplane, road or ferry, due to established interstate (or international in the 
case of travel to/from Alaska via the Alaska-Canada Highway) travel requirements. 
Furthermore, due to Alaska’s unique geographic location, the difficulty of traveling by road 
through northern Canada in winter, and the lengthy periods generally associated with traveling 
to/from Alaska by ferry, commercial airlines are the most common and popular mode of 
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interstate travel to/from Alaska, especially during the winter. 

Ransom Note and Transfer of Funds to “Ransom Accoun t^ 

14. On 02-24-2012, at 19:56 AST, D.T. received the following text on his cell phone 
907-231-9835 from S.K.’s cell phone 907-884-8370 - “Conner park sign under pic of albert aint 
she purty”. J.K. (S.K.’s father) contacted law enforcement officers and relayed the information. 
At the request of APD Detectives, at approximately 20:18 AST, APD Patrol Officers arrived at 
Conner Park located on the southeast comer of Jewel Lake Road and International Airport Road 
in Anchorage, Alaska. J.K.and D.T. were already present. Attached to the park sign, below a 
flyer for a lost dog named “Albert,” was a ziploc bag which contained a folded piece of paper. 

15. On one side of the piece of paper, there was a photograph of S.K. with silver duct 
tape around her mouth and chin. She appeared to be wearing eye liner, and a light-colored, 
latex-gloved hand and lightly complected, muscular arm was holding S.K.’s hair. In the upper 
part of the photo was an Anchorage Daily Newspaper determined to be the issue released on 
Monday, February 13, 2012. 

16. On the reverse side of the piece of paper was a ransom note which demanded 
$30,000. The note included the 16-digit card number of the debit card belonging to D.T., which 
he had reported stolen on the night of the kidnaping, as summarized above. This debit card 
number is correlated to a bank account number held by D.T. and S.K. The note demanded that 
$30,000.00 be deposited into that account and indicated that the writer of the note intended to 
withdraw money at regular intervals over the coming days, and in locations other than Alaska. 
Specifically, it said, “I may not use the card much in ak due to small pop but as I will be leaving 
soon I will be using it all over.” The note further gave an indication that S.K. had been moved 




from Alaska, stating that “she did almost get away twice, once on tudor and once in the desert, 
must be losing my touch.” I know from research, training, and experience, and discussions with 
law enforcement officers familiar with Alaska that there are no areas in Alaska commonly 
referred to and known to be “deserts.” Many such areas do exist in Arizona, New Mexico and 
Texas. Subsequent analysis of the demand note by the FBI Laboratory revealed that it was typed 
with a typewriter that used a carbon ribbon, and that the aforementioned picture on the back of 
the demand note was printed with an inkjet printer. 

17. On 02-29-2012, at approximately 16:55 AST, J.K. contacted APD Detectives and 
told them he was withdrawing $5,000.00 from the reward account set up for S.K. at Denali 
Alaskan Federal Credit Union, and he intended to deposit it in the ransom fund, which was an 
account held by Credit Union 1. Pursuant to a State search warrant obtained by APD Detective 
Joseph Barth on 02-25-2012, investigators were informed that $5,000.00 was deposited in the 
Credit Union 1 account indicated on the ransom note, (the account attached to the Credit Union 

1 VISA debit card [VISA debit card] bearing XXXXXXXXXXXX2851, expiration 01/15 issued 
to D.T).at 17:45 AST on 02-29-2012). 

Unauthorized use of Credit Union 1 VISA debit card 

18. On 02-29-2012 at 22:13 AST, an unknown person utilizing D.T.’s Credit Union 1 
debit card attempted to withdraw $600.00 in US Currency from the account indicated on the 
ransom note. The attempted withdrawal took place at the Automatic Teller Machine (ATM) 
located at the Alaska USA bank at 4000 Credit Union Drive in Anchorage, Alaska. Because the 
attempted amount was over the $500.00 daily limit, .the withdrawal was declined. Surveillance 
video in the area of the ATM revealed a male dressed in a black hooded sweatshirt and black 
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pants, operating a light-colored SUV, arrived in the parking lot of the Sea Galley restaurant 
across the street. After parking the SUV, the male exited and quickly walked across the street to 
the area of the Alaska USA ATM. The SUV was later determined by the FBI to be a silver 
Nissan Xterra of a model between the years 2005 and 2012. As noted below, police have now 
determined that KEYES' girlfriend owns a silver 2007 Nissan Xterra. 

19. On 02-29-2012 at 23:56 AST, $500.00 in US Currency was withdrawn from the 
ATM at the Denali Alaskan Federal Credit Union located at 3020 Minnesota Drive in 
Anchorage, Alaska. The debit card utilized to withdraw the money was the same Credit Union 1 
debit card issued to D.T. Surveillance video obtained of the area revealed this withdrawal was 
conducted by an unknown male with a muscular appearance wearing a dark-colored, possibly 
hooded, jacket with a light-colored design or paint spatter on the left chest and front, and light- 
colored lettering, including possibly "CORPS" across the back shoulders; clear or light-colored 
glasses; a gray face mask; gray gloves; dark-colored pants; and light-colored shoes. 

20. During the course of the investigation, Detective Blanton and Officer Pierce of 
APD obtained surveillance footage from businesses surrounding the Alaska USA, which is 
located on Credit Union Drive in Anchorage, Alaska. Immediately before the withdrawal, a 
hidden surveillance camera located at the Sea Galley at 4101 Credit Union Drive in Anchorage, 
Alaska captured a similarly dressed male park in the extreme southwest comer of the Sea Galley 
parking lot driving a silver Nissan Xterra. From the surveillance video, the male appeared to 
exit the vehicle and walk westbound across the street to the Alaska USA and return a short while 
later. Both the male’s appearance and timing are commensurate with him being the person who 
attempted to withdraw the money. 
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21. On 03-01-2012 at approximately 00:28 AST, $500.00 in US currency was 
withdrawn from the ATM at the Alaska USA located at 7701 Debarr Road in Anchorage, 


Alaska. As with the prior two transactions, the debit card utilized to withdraw the money was 
the Credit Union 1 debit card issued to D.T. 

22. On 03-07-2012 at approximately 21:57 AST, $400.00 in US currency was 
withdrawn from the ATM at the Western Bank located at 200 West Rex Allen Road in Willcox, 
Arizona. The debit card utilized to withdraw the money was the Credit Union 1 debit card 
issued to D.T. Surveillance video on the ATM showed the individual using the debit card for 
the withdrawal was a white male dressed in a gray hooded jacket or sweatshirt, glasses, a gray 
face mask, gray gloves, dark-colored pants, and light-colored shoes, and appeared to be driving a 
late model white Ford Focus sedan. 

23. On 03-07-2012 at approximately 23:24 AST, there was an attempted $400.00 
withdrawal at the Western Bank located at 711 Main Street in Lordsburg, New Mexico, using 
D.T.’s Credit Union 1 debit card (the same card referenced in prior paragraphs.) The withdrawal 
was declined by the ATM as it would have put the debit card over the daily withdrawal limit. 

At 23:25 AST, at the same ATM, a balance inquiry was conducted on the account utilizing the 
debit card. The balance shown was $3,598.91. At 23:26 AST, $80.00 was withdrawn from the 
account utilizing the debit card. Surveillance video on the ATM showed the individual using the 
debit card wore similar clothing to the first ATM withdrawal in Arizona. 

24. On 3-9-2012 at approximately 23:23 AST, there was a $483.00 withdrawal made 
■at an ATM at Houston Community Bank, 1515 FM 1960 Bypass East, Humble City, Texas. 
Initial review of the surveillance video from the ATM appeared to show that the individual using 
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the debit card wore similar clothing to that worn during the two aforementioned ATM 
withdrawals in Arizona and New Mexico. 

25. On 03-11-2012 at approximately 23:47 AST, there was a $480.00 withdrawal at 
the People’s State Bank located at 5850 Hwy 59 South, Shepherd, Texas using D.T.’s Credit 
Union 1 debit card (the same card referenced in prior paragraphs.) Surveillance video on the 
ATM showed the individual using the debit card wore similar clothing to the first ATM 
withdrawal in Arizona, as well as the subsequent withdrawals in New Mexico and Texas. 

stop of the White Ford Focus 

26. On 03/13/2012, at.approximately 11:00 Central Time (CT), Texas Ranger Steven 
Rayburn, was notified by Texas Department of Public Safety (DPS) Highway Patrol Corporal 
Bryan Henry (Corporal Henry) that a white Ford Focus sedan bearing Texas license plate 
DH4N930 was observed parked at the Quality Inn & Suites (QIS), 4306 South First Street, 
Lufkin, Texas, which is a short drive from Shepherd, Texas. 

27. On 03/13/2012, at approximately 11:15 CT, Ranger Rayburn responded to the 
QIS, at which time FBI Agent Deb Gannoway conducted a walk-by and visual inspection of the 
white Ford Focus. Gannoway noted a bar-code sticker on the driver's side back passenger 
window consistent with stickers applied to rental vehicles. She also noted numerous items of 
clothing, trash and other debris in plain sight within the vehicle, including what appeared to be a 
girl’s or woman’s pink item of clothing. Ranger Rayburn caused a Texas license plate database 
search to be conducted which revealed the white 2012 Ford Focus was registered to PV Holding 
Corporation, 9603 John Saunders Road, San Antonio, Texas. DPS Criminal Investigative 
Division (CID) Lieutenant Mickey Hadnot (Lieutenant Hadnot) maintained surveillance on the 





Ford Focus. 


28. On 03/13/2012, at approximately 11:30 CT, Lieutenant Hadnot reported to 
Ranger Rayburn, that a white male adult exited room 215 of the QIS, placed some items into the 
trunk of the aforementioned white Ford Focus, and departed the scene alone, driving the white 
Ford Focus. FBI Agent Deb Gannoway had previously obtained from the QIS front desk 
manager an "in house list" of all occupants of the QIS on the night of 03/12/2012, which 
reflected room 215 was rented by ELIJAH KEYES for the time period 03/09/2012 through 
03/13/2012. 

29. On 03/13/2012, at approximately 11:45 CT, Corporal Henry conducted a traffic 
stop on the white Ford Focus sedan based in part on FBI Agent Deb Gannoway’s suspicion that 
the vehicle was the same vehicle used in the Arizona, New Mexico, and Texas ATM 
withdrawals, as well as Corporal Henry's assessment that the driver of the vehicle was traveling 
in excess of the posted speed limit. Corporal Henry provided to FBI Agent Deb Gannoway 
Alaska Driver's License number 7268639, in the name of ISRAEL KEYES, which KEYES had 
provided to Corporal Henry. KEYES informed Corporal Henry he flew from Anchorage, 

Alaska, to Las Vegas, Nevada, on 03/07/2012, and that he rented the white Ford Focus at the Las 
Vegas airport, driving to his present location over the course of the ensuing week. KEYES 
provided to law enforcement officers a copy of his car rental agreement, which corroborated his 
statement that he had rented the car at the Las Vegas, Nevada, airport on 03/07/2012. KEYES 
was unable to describe to law enforcement officers the route he drove from Nevada tp Texas, but 
stated he was in Lufkin, Texas, to attend his sister's wedding in Wells, Texas. KEYES told 
officers he "probably" paid for fuel throughout his travels from Nevada to Texas with cash. 
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Ranger Rayburn observed that there was a pair of large white tennis shoes partially pushed under 
the driver's seat of the Ford Focus, which Ranger Rayburn could plainly see through the window. 
During questioning by FBI Agent Gannoway and Ranger Rayburn, KEYES became increasingly ■ 
agitated and uncooperative, and he refused to allow Ranger Rayburn to inspect his wallet (which 
was in his pocket) or his vehicle. KEYES became unusually nervous and began to sweat 
profusely, in spite of the slightly cool weather and the tank top which he was wearing at the 
time. KEYES expressed that if he was going to be kept in the area for a longer period of time, 
he desired to'call his brother (who has KEYES' daughter in a separate car) and notify him of 
same. Officers suggested KEYES make that call, A short time later, the 2012 Ford Focus was 
transported to and secured at the Lufkin, Texas, Police Department. 

30. Based on the aforementioned observations, including the fact that the rented Ford 
Focus matched the description of the vehicle utilized in the ATM withdrawals in Arizona, New 
Mexico and Texas, KEYES' arrival in Las Vegas, Nevada, and his subsequent travel from 
Nevada to Texas very likely resulting in KEYES traveling through Arizona on or about 
03/07/2012 (the date of a $400.00 ATM withdrawal in Arizona) and New Mexico on or about 
03/08/2012 (the date of an $80.00 ATM withdrawal in New Mexico), KEYES' appearance 
closely matching the description of the white male adult observed in videos of the above- 
described ATM withdrawals, KEYES' own admission that he lived in the Anchorage, Alaska, 
area, KEYES' Alaska driver's license reflecting an Anchorage, Alaska, address, the white tennis 
shoes under the driver's seat matching the description of the shoes worn by the white male adult 
observed in the videos of the above-described ATM, as well as other observations, Corporal 
Henry placed KEYES under arrest. Ranger Rayburn searched KEYES’ wallet, revealing a VISA 





ATM/DeBit card bearing account number XXXXXXXXXXXX2851, expiration date 01/15, in 
the name of D.T. This card is linked to the “ransom account” identified above, from which the 
withdrawals and attempted withdrawals summarized above were made. The search of KEYES 
pursuant to his arrest also revealed an AT&T Pantech flip cellular phone, blue and silver in 
color, Model #P2000, S/N 110301023456. 

Discovery of KEYES’ White Chevrolet Truck 

31. APD Detectives discovered that ISRAEL KEYES listed a mailing address of 
3705 Arctic Blvd. #2891 in Anchorage, Alaska, on 07-18-2011, which is the Mail Cache, APD 
Detectives also discovered that KEYES listed a residential address of 2456 Spurr Lane in 
Anchorage, Alaska, as of 07-18-2011. 

32. On 03-13-2012 at approximately 10:30 AST, members of the APD Special 
Assignment Unit went to KEYES’ home address at 2456 Spurr Lane in Anchorage, Alaska. No 
one answered repeated knocks on the door. Per APD Sergeant Redick, there were fresh tire 
impressions in the snow in the driveway of the address that appeared as if a vehicle had been 
parked there as recently as the morning of 03-13-2012. 

3 3. There was also a white Chevrolet pickup truck parked in the driveway of the 
address. The truck had a large toolbox in the bed and a ladder rack on top. The bolts securing 
those items were removable and appeared to have been recently added. The license plate on the 
truck was Alaska license plate FTC990, relating to a white 2004 Chevrolet Silverado, registered 
to ISRAEL KEYES at 2456 Spurr Lane in Anchorage, Alaska. The white Chevrolet truck 
appeared to match the vehicle appearing in the Home Depot surveillance video, as summarized 
above. Further, Detectives eventually contacted KEYES’ girlfriend and discovered that she 
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drives a 2007 Nissan Xterra, which matched the general description of the vehicle used by an 
individual who appeared to attempt to use the stolen debit card on 2-29-12, as summarized 
above. 

Discovery OF KEYES’ Computer Use and Use of Yahoo Account 

34. KEYES’ girlfriend, who also lives at his residence, was interviewed on 
approximately March 14, 2012. She indicated KEYES was out of Alaska. She also indicated 
that KEYES owned a laptop computer and that his computer was not in the residence. 

35. Alaska Airlines provided travel records for KEYES pursuant to a Federal Grand 
Jury Subpoena that was issued to them on March 14,2012. In reviewing the returns for this 
subpoena, travel records were found showing KEYES and his young daughter traveled to 
Houston on February 2, 2012. KEYES was originally scheduled to return on February 14, 2012 
but changed the ticket to return on February 17, 2012. The ticket was booked online October 1, 
2011 and an email confirmation was sent on the same date. The return ticket was changed to 
February 17, 2012 and an email confirmation was sent on 2/15/2012. The notes for this 
transaction indicate the email confirmation was sent to an email address believed to belong to 
A.K., the mother of KEYES’ daughter. However, the tickets were booked using A.K.’s credit 
card. A.K.does not reside in the state of Alaska and it is likely she had to forward the email 
confirmation to KEYES so that he would know the dates/times of travel. 

36. In reviewing the returns for this subpoena, travel records were also found showing 
KEYES and his young daughter traveled to Las Vegas on March 6, 2012 via Alaska Airlines. 
This ticket was booked online and he provided an email address with the reservation. The notes 
section of the travel records indicated the email address provided was 




israelkeves@vahoo.com . The records also indicated an email confirmation was sent to 
israelkeves@vahoo.com on March 1,2012. 

Execution of Search Warrant and Discovery of Cellular Telephone Matching 
Description of Phone Belonging to S.K. and Other Cellular Telephones and D igital Media 
Devices 

37. On March 16,2012, law enforcement agents in Beaumont, Texas obtained a search 
warrant which authorized-the search of the white Ford Focus driven by KEYES. Execution of 
that search warrant on March 17,2012 revealed numerous items, including a Samsung 
cellphone, black in color, slider type. Model# SCH-R631. Possible S/N 80015743 (this number 
is on the back of the phone but it does not indicate it as a S/N), which matched the description of 
S.K.’s cellular phone provided by S.K.’s boyfriend (per paragraph 9, S.K. is believed to have 
been carrying the phone when the kidnapping took place), a laptop computer; a DVD case; a 
Sony Cybershot Camera, silver in color. Model #DSC-S700, S/N 0522961; and a Sandisk M250 
MP3 Player, black in color, 2GB. The laptop computer, Samsung cellular phone, Sony 
Cybershot Camera, and Sandisk M250 MP3 player were all seized pursuant to the search of the 
vehicle. The DVD case was initially not seized, but were rather returned to KEYES mother, 
HEIDI KEYES. 

38. In my training and experience, I know that photos from digital cameras and 
cellular phones are frequently downloaded to computers and electronic tablets, and then printed 
or stored on media devices. I also know that cellular phones, computers, electronic tablets and 
similar devices are frequently used to arrange travel and hotel reservations, rent vehicles, and 
conduct other personal business related to traveling. I also know that computers and cellular 
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phones can be used to connect to the internet, which can be used to locate banks, ATM’s, hotels, 
maps, send email, draft documents, and communicate with others. I also know that storage 
devices for electronic information, or “thumb” drives, are often used to store such information 
for later use by computers, cellular phones and other media devices. I know that electronic 
records of all such uses of computers and similar electronic devices are retained within those 
devices and may be retrieved by forensic technicians. 

Interview of KEYES 

39. In an interview with defense counsel present on March 17,2012, KEYES admitted 
to using D.T.’s debit card at locations throughout the southwest United States. He also claimed 
that he received the debit card and the cellular telephone matching the description of S.K.’s 
telephone together in a plastic bag from an anonymous person, who left the plastic bag in his 
vehicle. Based on my training and experience, it appears very likely that the specifics of 
KEYES’ account of the origin of his possession of the phone and debit card is not truthful; 
however, his admission that the phone and debit card are associated with each other associates 
both items with S.K., and confirms the identification of the phone as belonging to S.K. During 
the interview, KEYES also indicated that a Micro SD Card belonging to the phone matching the 
description of S.K.’s phone was located within the DVD case that had been present in the white 
Ford Focus and had been returned to KEYES mother, HEIDI KEYES, following the search of 
that vehicle. 

Consensual Seizure of Lexar 4GB Micro SD card and LG Ce llular Telephone 

40. Following the interview with KEYES, law enforcement officers visited KEYES 
mother, HEIDI KEYES. During this visit, officers were informed that KEYES’ daughter, L.K.,' 
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who had been intermittently traveling with KEYES from March 6,2012 through March 13, 

2012, was in possession of a black flip-out LG Cellular Telephone S/N 104CYHE2202705. 

L.K, indicated that she had possessed this cellular phone while traveling with KEYES and that 
he had access to it throughout their intermittent travels. Officers requested that HEIDI KEYES, 
who was supervising L.K., consent to provide the black flip-out LG Cellular Telephone S/N 
104CYHE2202705. HEIDI KEYES consented to provide the phone, and officers subsequently 
seized it. Officers also requested that she allow officers to examine the DVD case found in the 
white Ford Focus and released to her, which KEYES had indicated in his interview contained a 
Micro SD chip for the cellular phone belonging to S.K. HEIDI KEYES consented to allow an 
examination of the DVD case. Pursuant to that examination, officers discovered a Lexar 4GB 
Micro SD card that appears to fit the cellular telephone belonging to S.K. HEIDI KEYES then 
consented to provide the SD Card to officers. Officers subsequently seized the SD card. 

40. The Devices listed at paragraph 2, above, are currently in the lawful possession of 
the FBI. The Devices came into the FBI possession as outlined above. Although the FBI might 
already have the lawful authority to examine the Devices, I seek this additional warrant out of an 
abundance of caution to be certain that an examination of the Devices will comply with the 
Fourth Amendment and other applicable laws. 

41. The Devices are currently in storage at FBI Anchorage Station, Anchorage, Alaska. 
In my training and experience, I know that the Devices have been stored in a manner in which 
their contents are, to the extent material to this investigation, in substantially the same state as 
they were when the Devices first came into the possession of the government. 
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TECHNICAL TERMS 


42. Based on my training, my experience, and information provided to me by other 
law enforcement personnel, I use the following technical terms to convey the following 
meanings: 

a. “Storage medium”: A storage medium is any physical object upon 
which data can be stored, including a cellular telephone’s flash 
memory or other data storage components, such as a SIM card. 

b. “Wireless telephone”: A wireless telephone (or mobile telephone, 
or cellular telephone) is a handheld wireless device used for voice 
and data communication through radio signals. These telephones 
send signals through networks of transmitter/receivers, enabling 
communication with other wireless telephones or traditional “land 
line” telephones. A wireless telephone usually contains a “call 
log,” which records the telephone number, date, and time of calls 
made to and from the phone. In addition to enabling voice 
communications, wireless telephones offer a broad range of 
capabilities. These capabilities include: storing names and phone 
numbers in electronic “address books”; sending, receiving, and 
storing text messages and e-mail; taking, sending, receiving, and 
storing still photographs and moving video; storing and playing 
back audio files; storing dates, appointments, and other 
information on personal calendars; and accessing and 
downloading information from the Internet. Wireless telephones ■ 
may also include global positioning system (“GPS”) technology 
for determining the location of the device. 

c. “Computer”: Pursuant to IB U.S.C. § 1030(e)(1), a computer is 
“an electronic, magnetic, optical, electrochemical, or other high 
speed data processing device performing logical or storage 
functions, and includes any data storage facility or 
communications facility directly related to or operating in 
conjunction with such device.” 

d. IP Address: An Internet Protocol address (or simply “IP Address”) 
is a unique numeric address used by computers on the Internet. 

An IP address is a series of four numbers, each in the range 0-255, 
separated by periods (e.g., 121.56.97.178). Every computer 
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attached to the Internet must be assigned an IP address so that 
Internet traffic sent from and directed to that compuiter may be 
directed properly from its source to its destination. Most Internet 
service providers control a range of IP addresses. Some computers 
have static- that is, long-term - IP addresses, while other 
computers have dynamic - that is, frequently changed - IP 
addresses. 

e. • Internet: The Internet is a global network of computers and othe 
electronic devices that communicate with each other. Due to the 
structure of the internet, connections between devices on the 
internet often cross state and international borders, even when the 
devices communicating with each other are in the same state. 


f. Portable media player: A portable media player (or “MP3 Player” 
or iPod) is a handheld digital storage device designed primarily to 
store and play audio, video, or photographic files. However, a 
portable media player can also store other digital data. Some 
portable media players can use removable storage media. 
Removable storage media include various types of flash memory 
cards or miniature hard drives. This removable 

storage media can also store any digital data. Depending on the 
model, a portable media player may have the ability to store very 
large amounts of electronic data and may offer additional features 
such as a calendar, contact list, clock, or games. 

g. .Digital camera: A digital camera is a camera that records pictures 
as digital picture files, rather than by using photographic film. 
Digital cameras use a variety of fixed and removable storage 
mediato store their recorded images. Images can usually be 
retrieved by connecting the camera to a computer or by connecting 
the removable storage medium to a separate reader. Removable 
storage media include various types of flash memory cards, SD 
cards or miniature hard drives. Most digital cameras also include 
a screen for viewing the stored images. This storage media can 
contain any digital data, including data unrelated to photographs or 
videos. 

h. Secure Digital (SD) Card; A Secure Digital (“SD”) Card is a 
removable computer memory chip for use in portable devices, 
including cellular phones, MP3 players and digital cameras. SD 
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cards store digital data in a format usable by a particular electronic 
device. 

43 Based on my training, experience, and research, I know that the Target 
Devices have capabilities that allow them to serve as a wireless telephone, digital camera, 
memory storage, and may also function as a computer and internet browser. In my training and 
experience, examining data stored on devices of this type can uncover, among other things, 
evidence that reveals or suggests who possessed or used the device. 

ELECTRONIC STORAGE AND FORENSIC ANALYSIS 

44. The applied-for warrant would authorize the forensic examination of the 
Target Devices for the purpose of identifying and seizing the electronically stored information 
particularly described in Attachment B in accordance with Federal Criminal Procedure Rule 
41(e)(2)(B) (“Warrant Seeking Electronically Stored Information”). 

45. Forensic evidence : As further described in Attachment B, this application 
seeks permission to locate not only electronically stored information that might serve as direct 
evidence of the crimes described on the warrant, but also forensic evidence that establishes how 
the Target Devices were used, the purpose of their use, who used them, and when. There is 
probable cause to believe that this forensic electronic evidence more likely than not is stored in 
the Target Devices because: 

a. Data on a storage medium can provide evidence of information 
that was once on the storage medium but has since been deleted or 
edited, or of a deleted portion of the information. 

b. Forensic evidence stored within the Target Devices can also 
indicate who has used or controlled the Target Devices. This 
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“user attribution” evidence is analogous to the search for “indicia 
of occupancy” while executing a search warrant at a residence. 

c. A person with appropriate familiarity with how the Target Devices 
works may, after examining this forensic evidence in its proper 
context, be able to draw conclusions about how electronic devices 
were used, the purpose of their use, who used them, and when. 

d. The process of identifying the exact electronically stored 
information on a storage medium that are necessary to draw an 
accurate conclusion is a dynamic process. Electronic evidence is 
not always data that can be merely reviewed by a review team and 
passed along to investigators. Whether data stored on a cellular 
telephone is evidence may depend on other information stored on 
the cellular telephone and the application of knowledge about how 
a cellular telephone operates. Therefore, contextual information 
necessary to understand other evidence also falls within the scope 
of the warrant. 

e. Further, in finding evidence of how the Target Devices was used, 
the purpose of its use, who used it, and when, sometimes it is 
necessary to establish that a particular thing is not present on a 
storage medium. 

f. Based on my knowledge, training and experience, I know that 
electronic devices can store information for long periods of time. 
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Similarly, things that have been viewed via the internet are 
typically stored for some period of time on the device. This 
information can sometimes be recovered with forensics tools. 

46. Nature of examination: Based on the foregoing, and consistent with Rule 
41(e)(2)(B), the warrant I am applying for would permit the examination of the Target Devices 
consistent with the warrant. The examination may require authorities to employ techniques, 
including but not limited to computer-assisted scans of the Target Devices’ entire storage 
medium, that might expose many parts of the devices to human inspection in order to determine 
whether it is evidence described by the warrant. 

47. Manner of execution : Because this warrant.seeks only permission to 
examine a cellular telephone already in law enforcement’s possession, the execution of this 
warrant does not involve the physical intrusion onto a premises. Consequently, I submit there is 
reasonable cause for the Court to authorize execution of the warrant at any time in the day or 
night. 

48. Forensic image retention: I hereby request judicial authorization to retain 
full copy of the Devices’ storage media after the review is complete (to the extent that this 
warrant does not already authorize me to retain that storage media as seized forfeitable property) 
and until further order of the Court. That judicial authorization is justified in this case in part 
because: 

a. Should the execution of the warrant uncover data that may later 
need to be introduced into evidence during a trial or other 
proceeding, the authenticity and the integrity of the evidence and 






the government’s forensic methodology may be contested issues, 
Retaining copies of seized storage media can be required to prove 
these facts. 

b. Returning the original storage medium to its owner will not allow 
for the preservation of that evidence. Even routine use of a 
cellular telephone may forever change the data it contains or 
eliminate data stored on it. 

c. Because the investigation is not yet complete, it is not possible to 
predict all possible defendants against whom evidence found on 
the storage medium might be used. That evidence might be used 
against persons who have no possessory interest in the storage 
media, or against persons yet unknown. Those defendants might 
be entitled to a copy of the complete storage media in discovery. 
Retention of the entire content of the storage medium assures that 
it will be available to all parties, including those known now and 
those later identified. 

d. The act of destroying or returning a Device could create an 
opportunity for a defendant to claim, falsely, that the destroyed or 
returned Devices contained evidence favorable to him. 
Maintaining a copy of the Devices’storage medium would permit 
the government, through an additional warrant if necessary, to 
investigate such a claim. 
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e. Similarly, should a defendant suggest an explanation for the 

presence of evidence on a storage medium, it may be necessary to 
investigate such an explanation by, among other things, 
re-examining the storage medium with that defense in mind. This 
may require an additional examination of the storage medium for 
evidence that is described in Attachment B but was not properly 
identified and segregated previously. 

CONCLUSION 

49. Based on my training and experience, and-the facts as set forth in this affidavit, 
there is probable cause to believe that on the following Devices, as set forth in paragraph 2 
above: 

a LEXAR 4GB MICRO SD CARD, further identified in Attachment A, for the 
information identified in Attachment B, 

There exists fruits, evidence, and instrumentalities of violations of Title 18, 
United States Code (USC), Section 1029(a)(5) (Fraud and Related Activity in Connection with 
Access Devices )(FRACAD); Title 18, United States Code, Section 1201 (Kidnapping); and 
Title 18, United States Code, Section 1202(b) (Ransom Money). 

50. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. 18 U.S.C. §§ 2703(a), (b)(1)(A) & 
(c)(1)(A). Specifically, the Court is “a district court of the United States... that - has 
jurisdiction over the offense being investigated.” 18 U.S.C. § 2711(3)(A)(I). 





51. The investigation of this case is ongoing and disclosure of the issuance of the 
search warrant could result in destruction of evidence and could also impact officer, witness and 
victim safety. Accordingly, pursuant to the case law outlined in the government’s motion to 
seal, I respectfully request that the search warrant, search warrant affidavit, attachments, and 
returns be sealed. 


7 "h naught. 

fsl Signature Redacted _ 

Special Agent Jolene Goeden 
Federal Bureau of Investigation 


SUBSCRIB|D and SWORN to before me 

, 2012 . 

, ■ i /s/John D. Roberts, USMJ g_ 

Signature Redacted 

Stkel Magistrate Judge 


IN THE MATTER OF THE SEARCH OF LEXAR 4GB MICRO SD CARD, CURRENTLY 
LOCATED AT FBI ANCHORAGE NON-DRUG EVIDENCE LOCKER 




KAREN L. LOEFFLER 
United States Attorney 

CRAIG M. WARNER 

Assistant U.S. Attorney 

Federal Building & U.S. Courthouse 

222 West Seventh Avenue, #9, Room 253 

Anchorage, Alaska 99513-7567 

Phone: (907) 271-5071 

Fax: (907) 271-1500 

E-mail: craig.wamer@usdoj.gov 


IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF ALASKA 


In the Matter of the Search of: 
LEXAR 4GB MICRO SD CARD 


) Case No.3:12-MJ-00138-JDR 

) 

) MOTION TO SEAL SEARCH 
) WARRANT, APPLICATION, 

) AFFIDAVIT FOR SEARCH 
) WARRANT, ATTACHMENTS, 
) AND RETURN 
) 

) FILED UNDER SEAL 


COMES NOW the United States of America, by and through undersigned 


counsel and hereby moves for an order sealing the Search Warrant, Application 
and Affidavit and Returns for the search warrant issued in the above-captioned 
matter until further order of this Court. 


The government makes this motion to protect the investigative integrity of 
the present case. The investigation of this case is ongoing and disclosure of the 





issuance of the search warrant could result in destruction of evidence and could 


also impact officer, witness and victim safety. 

Historically, courts have recognized a “general right to inspect and copy 
public records and documents, including judicial records and documents.” 
Kamakana v. City and Countv of Honolulu. 447 F.3d 1172, 1178 (9th Cir. 2006) 
citing Nixon v. Warner Communications. Inc.. 435 U.S. 589, 597 & n.7 (1978). 
Nonetheless, access to judicial records is not absolute. A narrow range of 
documents is not subject to the right of public access at all because the records 
have “traditionally.been kept secret for important policy reasons.” Id. citing 
Times Mirror Co. V. United States. 873 F.2d 1210,1219 (9th Cir. 1989). Ninth 
Circuit case law has identified two categories of documents that fall into this 
category: grand jury transcripts and warrant materials in the midst of a pre¬ 
indictment investigation. Id. Parties seeking to seal a judicial record not 
traditionally kept secret must provide compelling reasons to the court for doing so. 
Id. In general, “compelling reasons” are those sufficient to outweigh the public’s 
interest in disclosure. Id. at 1179. 

Based on the foregoing, the government respectfully requests this Court 
enter the attached proposed Order sealing said search warrant, Application and 

IN THE MATTER OF THE SEARCH OF LEXAR 4GB MICRO SD CARD, 
CURRENTLY LOCATED AT FBI ANCHORAGE NON-DRUG EVIDENCE LOCKER 
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Affidavit for Search Warrant, the Returns and this Motion and Order until said 
time as the government has time to review the information contained therein and 
act upon. 

RESPECTFULLY SUBMITTED this 22th day of March, 2012, in 
Anchorage, Alaska. 


KAREN L. LOEFFLER 

T T *' 1 ' 

Isl Signature Redacted 1st Signature Redacted 

t» ai. vvarner _ 

AssistarJ U.S. Attorney 

Federal Building & U.S. Courthouse 

222 West Seventh Avenue, #9, Room 253 

Anchorage, Alaska 99513 

Phone: (907) 271-5071 

Fax: (907) 271-1500 

E-mail: craig.wamer@usdoj.gov 


IN THE MATTER OF THE SEARCH OF LEXAR 4GB MICRO SD CARD, 
CURRENTLY LOCATED AT FBI ANCHORAGE NON-DRUG EVIDENCE LOCKER 
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IN THE UNITED STATES DISTRICT COURT 


FOR THE DISTRICT OF ALASKA 


In the Matter of the Search of: ) Case No.3:12-MI-00138-JDR 

) 

LEXAR 4GB MICRO SD CARD ) ORDER GRANTING MOTION 

) TO SEAL SEARCH WARRANT, 
) APPLICATION, AFFIDAVIT 
) FOR SEARCH WARRANT, 

) ATTACHMENTS AND 
) RETURN 
) 

) FILED UNDER SEAL 


The United States requests that the Search Warrant, Application, Affidavit, 
Attachments and the Return filed in the above-captioned case be sealed. 


This Court finds that the need for secrecy to protect the ongoing 


investigation and potential witnesses outweighs the public’s right to inspect and 
copy judicial records and documents. 

IT IS HEREBY ORDERED that: 

The Search Warrant, Application, Affidavit and Attachments filed in the 
above-captioned case, and the Return to be filed, be sealed until further order of 
this Court. 

Further, the United States Attorney’s Office is directed to notify the Court 





as soon as the need for secrecy passes by filing a motion to unseal records. 
DATED this 22nd day of March, 2012, at Anchorage^Taska. - • 

~~'' V -V^.' 

/s/John D. Roberts, USMJ ’ 

Signature Redacted 


vJOMN JL). KUonrciS 7‘' 
Unjjed States Magistrate Judge 











ft. AO*$3 (Rev, i 2/03) Search Wanant 


v United States District Court 

__ District of _ Alaska _ 

In the Matter of the Search of 

(Name, address or brief description of person or property lo be searched) 

SEARCH WARRANT 

Silver Sony Cybershot Camera, MOdei #DSC-S700, 

S/N 0522961 


Case Number: 3:12-mj-000139-J DR 


TO: _ S/A Jolene Goeden, FBI _and any Authorized Officer of the United States 

Affidavits) having been made before me by _ S/A Joiene Goeden, FBI _who has reason t0 believe 

Affiant 

that □[] on the person of, or QJljon the premises known as (name, description and/or location) 

See Attachment A, which is incorporated by reference, 


in the _District of_ Alaska _there is now 

concealed a certain person or property, namely {describe the person or property) 

See Attachment B, which is incorporated by reference. 


I am satisfied that the affidavit(s) and any record testimony establish probable cause to believe that the person or property so described 
is now concealed on the person or premises above-described and establish grounds for the issuance of this warrant. 

YOU ARE HEREBY COMMANDED to search on or before _ 4/1/2012 _ 

Date 

(not to exceed 10 days) the person or piace named above for the person or property specified, serving this warrant and making the 
search 0 in the daytime — 6:00 AM to 10:00 P.M. □ at anytime in the day or night as I find reasonable cause has been 
established and if the person or property be found there to seize same, leaving a copy of this warrant and receipt for the person 
or property taken, and prepare a written inventory of the person or property seized and promptly return this warrant to 

_ 1 _ as squired by law. 

U.S. Magistrate Judge (Rule 41(f)(4)) 


Date and Time Issued 7 

JOHN D. ROBERTS 

U.S. MAGISTRATE JUDGE 


^ ? Ay\ -fl-fc. 

City and ? 


/s/John D. Roberts, USMJ ^ 


■ f':. ' Signature Redacted 

... :Signatufe-(ii;juu^. • - - 








12/03) Search Warrant (Reverse) 


Case Number; 3:12-mj-000139-JDR 


DATE WARRANT RECEIVED 

3fczlz.Oil 


DATE AND TIME WARRANT EXECUTED _ 

3 ( ~2'Q\'2- &(&:OOpvY\ \ 


COPY OF WARRANT AND RECEIPT FOR ITEMS LEFT Wf 

j)d,Q . _ 


INVENTORY MADE IN THE PRESENCE OF 


INVENTORY OF PERSON OR PROPERTY TAKEN PURSUANT TO THE WARRANT 


-#JhSC-STOO, 



CERTIFICATION 


] swear that this inventory is a true and detailed-orif'.nnnf tv><> person or property taken by me on the warrant. 


^/s/ Signature Redacted 


5JlA- nsi 


Subscribed, sworn to, and returned before me this date. 


OQ'3- 


/s/Scott A. Oravec, USMJ 
Signature Redacted 








ATTACHMENT A 


The property to be searched is a Sony Cybershot camera, silver in color, Model #DSC- 
S700, S/N 0522961, currently located at the FBI building at 101 E. 6 Ih Ave., Anchorage, Alaska, 
in the non-drug evidence locker, 






ATTACHMENTS 




All records and information on the Target Device identified in Attachment A that relate to 
violations of Title 18, United States Code (USC), Section 1029(a)(5) (Fraud and Related Activity 
in Connection with Access Devices )(FRACAD); Title 18, United States Code, Section 1201 
(Kidnapping); and Title 18, United States Code, Section 1202(b) (Ransom Money), and involve 
ISRAEL KEYES since October 1,2011, including: 

1. Evidence of who used, owned, or controlled the Target Device, including logs, 
registry entries, configuration files, saved usernames and passwords, and 
documents. 

2. Evidence of the times the Target Device was used. 

3. Passwords, encryption keys, and other access devices that may be necessary to 
access the Target Device. 

4. Evidence of digital photographs and “metadata” associated with such photos, 
including geographic and/or Global Positioning System (GPS) data indicating the- 
physical location at which the photograph was taken, date and time stamps 
indicating the date and time of day the photograph was taken, and data indicating 
the identity of other electronic devices to which or from which photographs were 
uploaded, downloaded or otherwise transferred or copied, and when such transfers 
took place. 

5. Evidence of audio or video recordings, and “metadata” associated with such audio 
and video recordings, including geographic and/or Global Positioning System 
(GPS) data indicating the physical location at which the photograph was taken, 
date and time stamps indicating the date and time of day the photograph was 
taken, and data indicating the identity of other electronic devices to which or from 
which photographs were uploaded, downloaded or otherwise transferred or 
copied, and when such transfers took place. 

6. Contextual information necessary to understand the evidence described in- this 
attachment. 

As used above, the terms “records” and "information” include all of the foregoing items 
of evidence in whatever form and by whatever means they may have been created or stored, 
including any form of computer or electronic storage. -- - 




AO 106 (Rfev. 04/10) Application fora Search Warrant 


United States District Court 


for the 

District of Alaska 


In the Matter of the Search of 
(Briefly describe the property to be searched 
or identify the person by name and address) 


Silver Sony Cybershot Camera, MOdel #DSC-S700, S/N ) 


Case No. 3:12-mj-000139-JDR 


application for a search warrant 

pen^VpM^^ 

wgggftfeherein by reference 


located in the _District ot- 

person or describe the property to be seized): 

See Attachment B, which is incorporated herein by reference 


, there is now concealed (identify the 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
fif evidence of a crime; 

O contraband, fruits of crime, or other items illegally possessed; 
af property designed for use, intended for use, or used in committing a crime; 

□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 

Code Section a n . Offense Description 

18 U.S.C. 1029(a)(5) Access Device Fraud 

18U.S.C. 1201 Kidnapping 

18 U.S.C. 1202(b) Ransom Money 

sS'wlSiSiWStefeed herein by reference 
gf Continued on the attached sheet. 

a Delayed notice of days (give exact ending date if more than 30 days:-) is requested 

under 18 U.S.C. § 3103a, the basis of which is set forth on 

Isl Signature Redacted 


Sworn to before me and signed in my presence. 


Date: . 03/22/2012 


City and state: Anchorage, Alaska 


Joiene Goeden, F BI Special Agent __ 

' • ... 


.... ' /s/John D. Roberts, USMJ . 
i L Signature Redacted 

P. Roberts, Magistrate Ju 

» _Printed name.ahS.tUle - 









ATTACHMENT B 


All records and information on the Target Device identified in Attachment A that relate to 
violations of Title 18, United States Code (USC), Section 1029(a)(5) (Fraud and Related Activity 
in Connection with Access Devices )(FRACAD); Title 18, United States Code, Section 1201 
(Kidnapping); and Title 18, United States Code, Section 1202(b) (Ransom Money), and involve 
ISRAEL KEYES since October 1,2011, including: 


1. Evidence of who used, owned, or controlled the Target Device, including logs, 
registry entries, configuration files, saved usernames and passwords, and 
documents. 

2. Evidence of the times the Target Device was used. 

3. Passwords, encryption keys, and other access devices that may be necessary to 
access the Target Device . 

4. Evidence of digital photographs and “metadata” associated with such photos, 
including geographic and/or Global Positioning System (GPS) data indicating the 
physical location at which the photograph was taken, date and time stamps 
indicating the date and time of day the photograph was taken, and data indicating 
the identity of other electronic devices to which or from which photographs were 
uploaded, downloaded or otherwise transferred or copied, and when such transfers 
took place. 

5. Evidence of audio or video recordings, and “metadata” associated with such audio 
and video recordings, including geographic and/or Global Positioning System 
(GPS) data indicating the physical location at which the photograph was taken, 
date and time stamps indicating the date and time of day the photograph was 
taken, and data indicating the identity of other electronic devices to which or from 
which photographs were uploaded, downloaded or otherwise transferred or 
copied, and when such transfers took place. 

6. Contextual information necessary to understand the evidence described in this 
attachment. 

As used above, the terms “records” and “information” include all of the foregoing items 
of evidence in whatever form and by whatever means they may have been created or stored, 
including any form of computer or electronic storage. 




UNITED STATES DISTRICT COURT 
THE DISTRICT OF ALASKA 


IN THE MATTER OF THE SEARCH OF j Case No. 3:12-mj-00139-JDR 

SILVER SONY CYBERSHOT CAMERA, ) 

MODEL #DSC-S700, S/N 0522961 ) 

) 

) 

) 

_ , _ ; _ ) 

AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 

I, Jolene Goeden, being first duly sworn, hereby depose and state as follows: 

INTRODUCTION AND AGENT BACKGROUND 
1. I am a Special Agent of the Federal Bureau of Investigation (FBI). I have been a 
Special Agent of the FBI since April 2004. I am charged with the duty of investigating violations 
of the laws of the United States, collecting evidence in cases in which the United States is or may 
be a party in interest, and performing other duties imposed by law. I have been assigned to 
investigate most criminal matters within the jurisdiction of the FBI, including kidnapping 
matters, fraud matters and other white collar crime. 

' 2. I make this affidavit in support of an application under Rule 4! of the Federal Rules of 
Criminal Procedure for a warrant to search five electronic items seized during a common set of 
searches and pursuant to a common set of circumstances, as outlined below : 

SILVER SONY CYBERSHOT CAMERA, MODEL #DSC-S700, S/N 0522961, 




further identified in Attachment A, for the information identified in Attachment B. 

This item is currently located at FBI Anchorage at 101 East Sixth Avenue, Anchorage, 


Alaska, in the secure, non-drug evidence vault. 

3. As set forth herein, there is probable cause to believe that in the property to be searched 
there exists evidence of a crime, contraband, fruits of a crimes, or other items illegally possessed 
in violation of Title 18, United States Code (USC), Section 1029(a)(5) (Fraud and Related 
Activity in Connection with Access Devices )(FRACAD); Title 18, United States Code, Section 
1201 (Kidnapping); and Title 18, United States Code, Section 1202(b) (Ransom Money), as 


further described in Attachment A. 

RELEVANT STATUTES 

4. The Target Device contains evidence of and is an instrumentality used for 
violations of Title 18, USC, Section 1029(a)(5), Fraud and Related Activity in Connection with 
Access Devices, which provides that: 

Whoever knowingly and with intent to defraud effects transactions with 1 or more, awess 
deices sued to mother person or persons, to receive payment or any other togs of 
vita" an? 1-year per iod that aggregate value of which is equal to or greater than 

$ 1 , 000 ; 

and Title 18, United States Code, Section 1201 (Kidnaping), which provides that: 

Whoever unlawfully seines, confines, inveigles, decoys, 

and holds for ransom or reward or otherwise any person, except m the case: ofa m 
the parent thereof, when the person is willfully transported mmte^ateorfore, g 
commerce, regardless of whether the person was alive when "‘"’^ rst0te 

foreign commerce or uses the mail or any means, fccihty.or mstrumentthty of torstete 
or foreign commerce in committing or in furtherance of the commrssron of the offense, 

and Title 18, United States Code, Section 1202(b) (Ransom Money), which provides that:. 

Whoever receives, possesses, or disposes of any money or other property, or any portion 
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thereof, which has at any time been delivered as ransom or reward in connection with a 
violation of section 1201 of this title, knowing the same to be money or property which 
has been at any time delivered as such ransom or reward. 

6. The applied for warrant would authorize the forensic examination of the devices listed 
above in paragraph 2, and further identified in Attachment A, for the purpose of identifying 
electronically stored data particularly described in Attachment B. 

PROBABLE CAUSE 

7. The information contained below is from my personal knowledge and experience, 
information provided to me by other law enforcement personnel, or from those specific sources 
as set forth. Since this affidavit is being submitted for the limited purpose of seeking 
authorization to search the Devices listed in paragraph 2 above, I have not included each and 
every fact known to me regarding this investigation. I have set forth only the facts that I believe 
are necessary to establish a foundation to support the aforementioned request for a search 
warrant. 

. Abduction of S.K. 

8. On 2-2-12 at about 12:39 Alaska Standard Time (AST), Duncan, the owner of the 
Common Ground Coffee stand at 630 E. Tudor, Anchorage, Alaska, contacted APD dispatch. 
Duncan was calling from Oregon, where he was vacationing. He reported that while viewing his 
internet-based security system he saw one of his employees, 18-year-old S.K., appear to be 
abducted. Duncan said he was contacted by S.K.’s father (J.K.) and boyfriend (D.T.), who had 
been unable to locate her. This contact prompted Duncan to review his security video which 
showed an unknown man climb through the window of the coffee stand at about 20:00 AST on 


• # 

2-1-12 while SX was working. The video appears to show SX retreating a short distance and 
raising her hands in an apparent sign of submission to the man who subsequently climbed into 
the coffee stand, robbed SX and escorted her away from the scene. The abductor climbed 
through the window into the coffee stand without any significant difficulty. He appeared to be 
significantly taller than SX, who is 5'4" tall, but due to the limited lighting and quality of the 
video, a more accurate estimate of his height has not been made. The robber/abductor appeared 
to have a medium to large build and athletic movements. 

9. At the time of her abduction, SX was wearing a dark-colored jacket, a green 
shirt with light-colored stripes on the sleeves, a thin dark-colored bracelet, dark-colored pants, 
and dark-colored shoes. At the time of her abduction, SX was also believed to be in possession 
of a carabineer with three keys and possibly a white lanyard, a medium-to-large size leopard 
print purse, and a black cellular telephone with sliding keyboard. SX is a white female adult, 
approximately 5'4" tall, 150 pounds, 18 years old, with shoulder-length brown hair and brown 

eyes. 

10. Video surveillance appeared to show SX's robber/abductor wearing a dark- 
colored, possibly hooded, jacket, dark-colored glasses, a dark-colored face mask, dark-colored 
gloves, dark-colored pants; and dark-colored shoes. He appeared to be carrying a white coffee 
cup and a dark-colored bag. Although to date no weapon has been conclusively identified in the 
surveillance videos that captured this robbery/abduction, the scene was generally poorly lit and 
the robber/abductor was not always fully visible. Furthermore, SX's reaction appeared to be 
consistent with someone who was confronted or threatened with a weapon. In addition, during 
separate subsequent interviews, both S.K.'s father and boyfriend adamantly indicated that SX 
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was very strong-willed and would not have complied with a robber or abductor's demands, 
unless she had been threatened with a weapon. 

11. Surveillance video from a nearby Home Depot at approximately 19:54 AST on 2- 
1-12 showed a white Chevrolet extended cab truck roll through the Home Depot parking lot and 
park just east of an International House of Pancakes. From a distance, the surveillance showed 
an individual with a black garment and hat get out of.be truck and walk westbound through the 
parking lot towards Denali St, cross it, get on the sidewalk, walk southbound on Denali St. to 
Tudor Rd., cross Tudor Rd. at the intersection, and, finally, exit the frame. The individual s 
travel was in the direction of the Common Ground Coffee stand, from which S.K. was abducted. 
One minute later, the video surveillance footage from Common Ground Coffee stand showed the 
individual who abducted S.K. approach from the direction of the man in the Home Depot video. 
Approximately two minutes after S.K. and her abductor exited the frame of the Common 
Ground Coffee stand video footage, two persons appearing to match S.K. and her abductor again 
entered the frame of the Home Depot video footage, this time walking back towards the location 
where the white Chevrolet truck was originally parked. The Home Depot video then showed the 
two people approach the passenger side door of the Chevrolet truck. It then showed the person 
who appeared to be S.K. enter the passenger side of truck. The other individual then walked 
around truck, entered the driver's side, and drove out of the surveillance video’s frame. As 
described below, police have now identified KEYES’ residence and located a white Chevrolet 
truck registered to him at that residence. This white Chevrolet truck belonging to KEYES 
appears to match the vehicle in the Home Depot surveillance footage, although KEYES’ truck 
has several toolboxes and a ladder rack fastened with removable bolts to the truck bed, and these 


5 




items do not appear on the truck in the Home Depot video. 

12.. During an interview on 02-02-2012, D.T. (S.K.’s boyfriend) said he went to the 
coffee stand on 2-1-12 at about 20:33 AST to give her a ride home but the stand appeared to be 
closed and she was not there. D.T. further reported to law enforcement that on 02/02/2012, at 
approximately 03:00 AST, he observed an unknown male adult wearing a ski mask and dark 
clothing going through the vehicle he shared with S.K. D.T. did not alert authorities to the 
burglary of the vehicle at that time. 

13. When D.T. was asked where his ATM debit card was by APD Detectives several 
days after the abduction, he indicated he had left it in the vehicle he shared with S.K. This 
vehicle had been seized by APD on 02-02-2012 and searched pursuant to a State of Alaska 
search warrant. The debit card referenced above was not located during the search; however law 
enforcement did not notify D.T. of this fact D.T. indicated that his debit card was a Credit 
Union 1 VISA debit card (VISA debit card) bearing XXXXXXXXXXXX2851, expiration 
01/15, and that he did not give his VISA debit card to anyone else or give anyone permission to 
use it. The card is thus believed to have been stolen from D.T.'s vehicle at the time D.T. 
observed the vehicle break-in. D.T. further related that S.K.’s driver’s license had also been in 
his vehicle. That driver’s license was missing when searched for on 02-02-2012, indicating that 
it also was stolen at that time. I know that a driver’s license is generally necessary to leave the 
State of Alaska by airplane, road or ferry, due to established interstate (or international in the 
case of travel to/from Alaska via the Alaska-Canada Highway) travel requirements. 
Furthermore, due to Alaska’s unique geographic location, the difficulty of traveling by road 
through northern Canada in winter, and the lengthy periods generally associated with traveling 
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to/from Alaska by ferry, commercial airlines are the most common and popular mode of 
interstate travel to/from Alaska, especially during the winter. 

ttansftm Note and Transfer of Fun ds to “Ransom Account!! 

14. On 02-24-2012, at 19:56 AST, D.T. received the following text on his cell phone 
907-231-9835 from S.K.’s cell phone 907-884-8370 - “Conner park sign under pic of albert aint 
she purty”. J.K. (S.K.’s father) contacted law enforcement officers and relayed the information. 

At the request of APD Detectives, at approximately 20:18 AST, APD Patrol Officers arrived at 
Conner Park located on the southeast comer of Jewel Lake Road and International Airport Road 
in Anchorage, Alaska. JXand D.T. were already present. Attached to the park sign, below a 
flyer for a lost dog named “Albert,” was a ziploc bag which contained a folded piece of paper. 

15. . On one side of the piece of paper, there was a photograph of S.K. with silver duct 
tape around her mouth and chin. She appeared to be wearing eye liner, and a light-colored, 
latex-gloved hand and lightly complected, muscular arm was holding S.K.'s hair. In the upper 
part of the photo was an Anchorage Daily Newspaper determined to be the issue released on 
Monday, F ebruary 13,2012. 

16. On the reverse side of the piece of paper was a ransom note which demanded 
$30,000. The note included the 16-digit card number of the debit card belonging to D.T., which 
he had reported stolen on the night of the kidnaping, as summarized above. This debit card 
number is correlated to a bank account number held by D.T. and S.K. The note demanded that 
$30,000.00 be deposited into that account and indicated that the writer of the note intended to 
withdraw money at regular intervals over the coming days, and in locations other than Alaska. 
Specifically, it said, “I may not use the card much in ak due to small pop but as I will be leaving 
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soon I will be using it all over.” The note further gave an indication that S.K. had been moved 
from Alaska, stating that “she did almost get away twice, once on tudor and once in the desert, 
must be losing my touch.” I know from research, training, and experience, and discussions with 
law enforcement officers familiar with Alaska that there are no areas in Alaska commonly 
referred to and known to be “deserts.” Many such areas do exist in Arizona, New Mexico and 
Texas, Subsequent analysis of the demand note by the FBI Laboratory revealed that it was typed 
with a typewriter that used a carbon ribbon, and that the aforementioned picture on the back of 
the demand note was printed with an inkjet printer. 

17. On 02-29-2012, at approximately 16:55 AST, J.K. contacted APD Detectives and 
told them he was withdrawing $5,000.00 from the reward account set up for S.K. at Denali 
Alaskan Federal Credit Union, and he intended to deposit it in the ransom fund, which was an 
account held by Credit Union 1. Pursuant to a State search warrant obtained by APD Detective 
Joseph Barth on 02-25-2012, investigators were informed that $5,000.00 was deposited in the 
Credit Union 1 account indicated on the ransom note, (the account attached to the Credit Union 

1 VISA debit card [VISA debit card] bearing XXXXXXXXXXXX2851, expiration 01/15 issued 
to D.T).at 17:45 AST on 02-29-2012). 

Unauthorized use of Credit Union 1 VISA debit card 

18. On 02-29-2012 at 22:13 AST, an unknown person utilizing D.T.’s Credit Union 1 
debit card attempted to withdraw $600.00 in US Currency from the account indicated on the 
ransom note. The attempted withdrawal took place at the Automatic Teller Machine (ATM) 
located at the Alaska USA bank at 4000 Credit Union Drive in Anchorage, Alaska. Because the 
attempted amount was over the $500.00 daily limit, the withdrawal was declined. Surveillance 




video in the area of the ATM revealed a male dressed in a black hooded sweatshirt and black 
pants, operating a light-colored SUV, arrived in the parking lot of the Sea Galley restaurant 
across the street. After parking the SUV, the male exited and quickly walked across the street to 
the area of the Alaska USA ATM. The SUV was later determined by the FBI to be a silver 
Nissan Xterra of a model between the years 2005 and 2012. As noted below, police have now 
determined that KEYES' girlfriend owns a silver 2007 Nissan Xterra. 

19. On 02-29-2012 at 23:56 AST, $500,00 in US Currency was withdrawn from the 
ATM at the Denali Alaskan Federal Credit Union located at 3020 Minnesota Drive in 
Anchorage, Alaska. The debit card utilized to withdraw the money was the same Credit Union 1 

' s vi-v." '”■■■■ 

debit card issued to D.T. Surveillance video obtained of the area'revealed this withdrawal was 
conducted by an unknown male with a muscular appearance we'ariftg ^'dark-colored, possibly 
hooded, jacket with a light-colored design or paint spatter on the left chest and front, and light- 
colored lettering, including possibly "CORPS" across the back shoulders; clear or light-colored 
glasses; a gray face mask; gray gloves; dark-colored pants; and light-colored shoes. 

20. During the course of the investigation, Detective Blanton and Officer Pierce of 
APD obtained surveillance footage from businesses surrounding the Alaska USA, which is 
located on Credit Union Drive in Anchorage, Alaska. Immediately before the withdrawal, a 
hidden surveillance camera located at the Sea Galley at 4101 Credit Union Drive in Anchorage, 
Alaska captured a similarly dressed male park in the extreme southwest comer of the Sea Galley 
parking lot driving a silver Nissan Xterra. From the surveillance video, the male appeared to 
exit the vehicle and walk westbound across the street to the Alaska USA and return a short while 
later. Both the male’s appearance and timing are commensurate with him being the person who 








attempted to withdraw the money. 

21. On 03-01-2012 at approximately 00:28 AST, $500.00 in US currency was 

. withdrawn from the ATM at the Alaska USA located at 7701 Debate Road in Anchorage, 

Alaska. As with the prior two transactions, the debit card utilized to withdraw the money was 

the Credit Union 1 debit card issued to D.T. 

22. On 03-07-2012 at approximately 21:57 AST, $400.00 in US currency was 
withdrawn from the ATM at the Western Bank.located at 200 West Rex Allen Road in Willcox, 
Arizona. The debit card utilized to withdraw the money was the Credit Union 1 debit card 
issued to D.T. Surveillance video on the ATM showed the individual using the debit card for 
the withdrawal was a white male dressed in a gray hooded jacket or sweatshirt, glasses, a gray 
face mask, gray gloves, dark-colored pants, and light-colored shoes, and appeared to be driving a 
late model white Ford Focus sedan. 

23. On 03-07-2012 at approximately 23:24 AST, there was an attempted $400.00 
withdrawal at the Western Bank located at 711 Main Street in Lordsburg, NeW Mexico, using 
D.T.'s Credit Union 1 debit card (the same card referenced in prior paragraphs.) The withdrawal 
was declined by the ATM as it would have put the debit card over the daily withdrawal limit. 

At 23:25 AST, at the same ATM, a balance inquiry was conducted on the account utilizing the 
debit card. The balance shown was $3,598.91. At 23:26 AST, $80.00 was withdrawn from the 
account utilizing the debit card. Surveillance video on the ATM showed the individual using the 
debit card wore similar clothing to the first ATM withdrawal in Arizona. 

24. On 3-9-2012 at approximately 23:23 AST, there was a $483.00 withdrawal made 

at an ATM at Houston Community Bank, 1515 FM 1960 Bypass East, Humble City, Texas. 
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Initial review of the surveillance video from the ATM appeared to show that the individual using 
the debit card wore similar clothing to that worn during the two aforementioned ATM 
withdrawals in Arizona and New Mexico. 

25. On 03-11-2012 at approximately 23:47 AST, there was a $480.00 withdrawal at 
the People's State Bank located at 5850 Hwy 59 South, Shepherd, Texas using D.T.’s Credit 
Union 1 debit card (the same card referenced in prior paragraphs.) Surveillance video on the 
ATM showed the individual using the debit card wore similar clothing to the first ATM 
withdrawal in Arizona, as well as the subsequent withdrawals in New Mexico and Texas. 

Stop of the White Ford Focus 

26. On 03/13/2012, at approximately 11:00 Central Time (CT), Texas Ranger Steven 
Rayburn, was notified by Texas Department of Public Safety (DPS) Highway Patrol Corporal 
Bryan Henry (Corporal Henry) that a white Ford Focus sedan bearing Texas license plate 
DH4N930 was observed parked at the Quality Inn & Suites (QIS), 4306 South First Street, 
Lufkin, Texas, which is a short drive from Shepherd, Texas. 

27. On 03/13/2012, at approximately 11:15 CT, Ranger Rayburn responded to the 
QIS, at which time FBI Agent Deb Gannoway conducted a walk-by and visual inspection of the 
white Ford Focus. Gannoway noted a bar-code sticker on the driver's side back passenger 
window consistent with stickers applied to rental vehicles. She also noted numerous items of 
clothing, trash and other debris in plain sight within the vehicle, including what appeared to be a 
girl's or woman's pink item of clothing. Ranger Rayburn caused a Texas license plate database 
search to be conducted which revealed the white 2012 Ford Focus was registered to PV Holding 
Corporation, 9603 John Saunders Road, San Antonio, Texas. DPS Criminal Investigative 
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Division (CID) Lieutenant Mickey Hadnot (Lieutenant Hadnot) maintained surveillance on the 
Ford Focus. 

28. On 03/13/2012, at approximately 11:30 CT } Lieutenant Hadnot reported to 
Ranger Rayburn, that a white male adult exited room 215 of the QIS, placed some items into the 
trunk of the aforementioned white Ford Focus, and departed the scene alone, driving the white 
Ford Focus. FBI Agent Deb Gannoway had previously obtained from the QIS front desk 
manager an "in house list" .of all occupants of the QIS on the night of 03/12/2012, which 
reflected room 215 was rented by ELIJAH KEYES for the time period 03/09/2012 through 
03/13/2012. 

29. On 03/13/2012, at approximately 11:45 CT, Corporal Henry conducted a traffic 
stop on the white Ford Focus sedan based in part on FBI Agent Deb Gannoway’s suspicion that 
the vehicle was the same vehicle used in the Arizona, New Mexico, and Texas ATM 
withdrawals, as well as Corporal Henry’s assessment that the driver of the vehicle was traveling 
in excess of the posted speed limit. Corporal Henry provided to FBI Agent Deb Gannoway 
Alaska Driver's License number 7268639, in the name of ISRAEL KEYES, which KEYES had 
provided to Corporal Henry. KEYES informed Corporal Henry he flew from Anchorage, 
Alaska, to Las Vegas, Nevada, on 03/07/2012, and that he rented the white Ford Focus at the Las 
Vegas airport, driving to his present location over the course of the ensuing week. KEYES 
provided to law enforcement officers a copy of his car rental agreement, which corroborated his 
statement that he had rented the car at the Las Vegas, Nevada, airport on 03/07/2012. KEYES 
was unable to describe to law enforcement officers the route he drove from Nevada to Texas, but 
stated he was in Lufkin' Texas, to attend his sister’s wedding in Wells, Texas. KEYES told 


officers he "probably” paid for fuel throughout his travels from Nevada to Texas with cash. 
Ranger Rayburn observed that there was a pair of large white tennis shoes partially pushed under 
the driver's seat of the Ford Focus, which Ranger Rayburn could plainly see through the window. 
During questioning by FBI Agent Gannoway and Ranger Rayburn, KEYES became increasingly 
agitated and uncooperative, and he refused to allow Ranger Rayburn to inspect his wallet (which 
was in his pocket) or his vehicle. KEYES became unusually nervous and began to sweat 
profusely, in spite of the slightly cool weather and the tank top which he was wearing at the 
time. KEYES expressed that if he was going to be kept in the area for a longer period of time, 
he desired to call his brother (who has KEYES' daughter in a separate car) and notify him of 
same. Officers suggested KEYES make that call. A short time later, the 2012 Ford Focus was 
transported to and secured at the Lufkin, Texas, Police Department. 

30. Based on the aforementioned observations, including the fact that the rented Ford 
Focus matched the description of the vehicle utilized in the ATM withdrawals in Arizona, New 
Mexico and Texas, KEYES 1 arrival in Las Vegas, Nevada, and his subsequent travel from 
Nevada to Texas very likely resulting in KEYES traveling through Arizona on or about 
03/07/2012 (the date of a $400.00 ATM withdrawal in Arizona) and New Mexico on or about 
03/08/2012 (the date of an $80.00 ATM withdrawal in New Mexico), KEYES’ appearance 
closely matching the description of the white male adult observed in videos of the above- 
described ATM withdrawals, KEYES’ own admission that he lived in the Anchorage, Alaska, 
area, KEYES’ Alaska driver's license reflecting an Anchorage, Alaska, address, the white tennis 
shoes under the driver's seat matching the description of the shoes worn by the white male adult 
observed in the videos of the above-described ATM, as well as other observations. Corporal 






Henry placed KEYES under arrest. Ranger Rayburn searched KEYES’ wallet, revealing a VISA 
ATM/Debit card bearing account number XXXXXXXXXXXX2851, expiration date 01/15, in 
the name of D.T. This card is linked to the “ransom account” identified above, from which the 
withdrawals and attempted withdrawals summarized above were made. The search of KEYES 
pursuant to his arrest also revealed an AT&T Pantech flip cellular phone, blue and silver in 
color, Model #P2000, S/N 110301023456. 

Discovery of KEYES’ White Chevrolet Truck 

31. APD Detectives discovered that ISRAEL KEYES listed a mailing address of 
3705 Arctic Blvd. #2891 in Anchorage, Alaska, on 07-18-2011, which is the Mail Cache. APD 
Detectives also discovered that KEYES listed a residential address of 2456 Spurr Lane in 
Anchorage, Alaska, as of 07-18-2011. 

32. On 03-13-2012 at approximately 10:30 AST, members of the APD Special 
Assignment Unit went to KEYES’ home address at 2456 Spurr Lane in Anchorage, Alaska. No 
one answered repeated knocks on the door. Per APD Sergeant Redick, there were fresh tire 
impressions in the snow in the driveway of the address that appeared as if a vehicle had been 
parked there as recently as the morning of 03-13-2012. 

33. There was also a white Chevrolet pickup truck parked in the driveway of the 
address. The truck had a large toolbox in the bed and a ladder rack on top. The bolts securing 
those items were removable and appeared to have been recently added. The license plate on the 
truck was Alaska license plate FTC990, relating to a white 2004 Chevrolet Silverado, registered 
to ISRAEL KEYES at 2456 Spurr Lane in Anchorage, Alaska. The white Chevrolet truck 
appeared to match the vehicle appearing in the Home Depot surveillance video, as summarized 
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above. Further, Detectives eventually contacted KEYES’ girlfriend and discovered that she 
drives a 2007 Nissan Xterra, which matched the general description of the vehicle used by an 
individual who appeared to attempt to use the stolen debit card on 2-29-12, as summarized 
above. 

Discovery OF KEYES’ Computer Use and Use of Y ahoo Account 

34. KEYES' girlfriend, who also lives at his residence, was interviewed on 
approximately March 14,2012. She indicated KEYES was out of Alaska. She also indicated 
that KEYES owned a laptop computer and that his computer was not in the residence. 

35. Alaska Airlines provided travel records for KEYES pursuant to a Federal Grand 
Jury Subpoena that was issued to them on March 14, 2012. In reviewing the returns for this 
subpoena, travel records were found showing KEYES and his young daughter traveled to 
Houston on February 2, 2012. KEYES was originally scheduled to return on February 14,2012 
but changed the ticket to return on February 17, 2012. The ticket was booked online October 1, 
2011 and an email confirmation was sent on the same date. The return ticket was changed to 
February 17, 2012 and an email confirmation was sent on 2/15/2012. The notes for this 
transaction indicate the email confirmation was sent to an email address believed to belong to 
A.K., the mother of KEYES’ daughter. However, the tickets were booked using A.K.’s credit 
card. A.K.does not reside in the state of Alaska and it is likely she had to forward the email 
confirmation to KEYES so that he would know the dates/times of travel. 

36. In reviewing the returns for this subpoena, travel records were also found showing 
KEYES and his young daughter traveled to Las Vegas on March 6, 2012 via Alaska Airlines. 
This ticket was booked online and he provided an email address with the reservation. The notes 
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section of the travel records indicated the email address provided was 
israelkeves@vahoo.com . The records also indicated an email confirmation was sent to 
israelkeves@vahoo.com on March 1, 2012. 

Execution of Search Warrant and Discovery of Cellular Telephone Matching 
Descrintion of Phone Belonging to S.K. and Ot h er Cellu lar Telephones and Digital Media 
Devices 

37. On March 16,2012, law enforcement agents in Beaumont, Texas obtained a search 
warrant which authorized the search of the white Ford Focus driven by KEYES. Execution of 
that search warrant on March 17,2012 revealed numerous items, including a Samsung 
cellphone, black in color, slider type. Model# SCH-R631. Possible S/N 80015743 (this number 
is on the back of the phone but it does not indicate it as a S/N), which matched the descnption of 
S.K.’s cellular phone provided by S.K.’s boyfriend (per paragraph 9, S.K. is believed to have 
been carrying the phone when the kidnapping took place), a laptop computer; a DVD case; a 
Sony Cybershot Camera, silver in color, Model #DSC-S700, S/N 0522961; and a Sandisk M250 
MP3 Player, black in color, 2GB. The laptop computer, Samsung cellular phone, Sony 
Cybershot Camera, and Sandisk M250 MP3 player were all seized pursuant to the search, of the 
vehicle. The DVD case was initially not seized, but were rather returned to KEYES mother, 
HEIDI KEYES. 

38. In my training and experience, I know that photos from digital cameras and 
cellular phones are frequently downloaded to computers and electronic tablets, and then printed 
or stored on media devices. I also know that cellular phones, computers, electronic tablets and 
similar devices are frequently used to arrange travel and hotel reservations, rent vehicles, and 
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conduct other personal business related to traveling. I also know that computers and cellular 
phones can be used to connect to the internet, which can be used to locate banks, ATM’s, hotels, 
maps, send email, draft documents, and communicate with others. I also know that storage 
devices for electronic information, or “thumb” drives, are often used to store such information 
for later use by computers, cellular phones and other media devices. I know that electronic 
records of all such uses of computers and similar electronic devices are retained within those 
devices and may be retrieved by forensic technicians. 

Interview of KEYES 

39. In an interview with defense counsel present on March 17,2012, KEYES admitted 
to using D.T.’s debit card at locations throughout the southwest United States. He also claimed 
that he received the debit card and the cellular telephone matching the description of S.K.’s 
telephone together in a plastic bag from an anonymous person, who left the plastic bag m his 
vehicle. Based on my training and experience, it appears very likely that the specifics of 
KEYES’ account of the origin of his possession of the phone and debit card is not truthful, 
however, his admission that the phone and debit card are associated with each other associates 
both items with S.K., and confirms the identification of the phone as belonging to S.K. During 
the interview, KEYES also indicated that a Micro SD Card belonging to the phone matching the 
description of S.K.’s phone was located within the DVD case that had been present in the white 
Ford Focus and had been returned to KEYES mother, HEIDI KEYES, following the search of 
that vehicle. 

Consensual Seizure of Lexar 4GB Micro SD card and LG Cellular Telephone 






40. Following the interview with KEYES, law enforcement officers visited KEYES 
mother, HEIDI KEYES. During this visit, officers were informed that KEYES’ daughter, L.K., 
who had been intermittently traveling with KEYES from March 6,2012 through March 13, 
2012, was in possession of a black flip-out LG Cellular Telephone S/N 104CYHE2202705. 

L.K. indicated that she had possessed this cellular phone while traveling with KEYES and that 
he had access to it throughout their intermittent travels. Officers requested that HEIDI KEYES, 
who was supervising L.K., consent to provide the black flip-out LG Cellular Telephone S/N 
104CYHE2202705. HEIDI KEYES consented to provide the phone, and officers subsequently 
seized it. Officers also requested that she allow officers to examine the DVD case found in the 
white Ford Focus and released to her, which KEYES had indicated in his interview contained a 
Micro SD chip for the cellular phone belonging to S.K. HEIDI KEYES consented to allow an 
examination of the DVD case. Pursuant to that examination, officers discovered a Lexar 4GB 
Micro SD card that appears to fit the cellular telephone belonging to S.K. HEIDI KEYES then 
consented to provide the SD Card to officers. Officers subsequently seized the SD card. 

40. The Devices listed at paragraph 2, above, are currently in the lawful possession of 
the FBI. The Devices came into the FBI possession as outlined above. Although the FBI might 
already have the lawful authority to examine the Devices, I seek this additional warrant out of an 
abundance of caution to be certain that an examination of the Devices will comply with the 
Fourth Amendment and other applicable laws. 

41. The Devices are currently in storage at FBI Anchorage Station, Anchorage, Alaska. 
In my training and experience, I know that the Devices have been stored in a manner in which 
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their contents are, to the extent material to this investigation, in substantially the same state as 
they were when the Devices first came into the possession of the government. 

TECHNICAL TERMS 

42. Based on my training, my experience, and information provided to me by other 
law enforcement personnel, I use the following technical terms to convey the following 
meanings: 


a. “Storage medium”: A storage medium is any physical object upon 
which data can be stored, including a cellular telephone’s flash 
memory or other data storage components, such as a SIM card. 

b. “Wireless telephone”: A wireless telephone (or mobile telephone, 
or cellular telephone) is a handheld wireless device used for voice 
and data communication through radio signals. These telephones 
send signals through networks of transmitter/receivers, enabling. 
communication with other wireless telephones or traditional “land 
line” telephones. A wireless telephone usually contains a “call 
log,” which records the telephone number, date, and time of calls 
made to and from the phone. In addition to enabling voice 
communications, wireless telephones offer a broad range of 
capabilities. These capabilities include: storing names and phone 
numbers in electronic “address books”; sending, receiving, and 
storing text messages and e-mail; taking, sending, receiving, and 
storing still photographs and moving video; storing and playing 
back audio files; storing dates, appointments, and other 
information on personal calendars; and accessing and 
downloading information from the Internet. Wireless telephones 
may also include global positioning system (“GPS”) technology 
for determining the location of the device. 

c. “Computer”: Pursuant to 18 U.S.C. § 1030(e)(1), a computer is 
“an electronic, magnetic, optical, electrochemical, or other high 
speed data processing device performing logical or storage 
functions, and includes any data storage facility or 
communications facility directly related to or operating in 
conjunction with such device.” 
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d. IP Address: An Internet Protocol address (or simply “IP Address”) 
is a unique numeric address used by computers on the Internet. 

An IP address is a series of four numbers, each in the range 0-255, 
separated by periods (e.g., 121.56.97.178). Every computer 
attached to the Internet must be assigned an IP address so that 
Internet traffic sent from and directed to that compuiter may be 
directed properly from its source to its destination. Most Internet 
service providers control a range of IP addresses. Some computers 
have static- that is, long-term - IP addresses, while other 
computers have dynamic - that is, frequently changed - IP 
addresses. 

e. Internet: The Internet is a global network of computers and othe 
electronic devices that communicate with each other. Due to the 
structure of the internet, connections between devices on the 
internet often cross state and international borders, even when the 
devices communicating with each other are in the same state. 


f. Portable media player: A portable media player (or “MP3 Player” 
or iPod) is a handheld digital storage device designed primarily to 
store and play audio, video, or photographic files. However, a 
portable media player can also store other digital data. Some 
portable media players can use removable storage media. 
Removable storage media include various types of flash memory 
cards or miniature hard drives. This removable 

storage media can also store any digital data. Depending on the 
model, a portable media player may have the ability to store very 
large amounts of electronic data and may offer additional features 
such as a calendar, contact list, clock, or games. 

g. Digital camera: A digital camera is a camera that records pictures 
as digital picture files, rather than by using photographic film. 
Digital cameras use a variety of fixed and removable storage 
media to store their recorded images. Images can usually be 
retrieved by connecting the camera to a computer or by connecting 
the removable storage medium to a separate reader. Removable 
storage media include various types of flash memory cards, SD 
cards or miniature hard drives. Most digital cameras also include 
a screen for viewing the stored images. This storage media can 
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contain any digital data, including data unrelated to photographs or 
videos. 

h. Secure Digital (SD) Card: A Secure Digital (“SD”) Card is a 
removable computer memory chip for use in portable devices, 
including cellular phones, MP3 players and digital cameras. SD 
cards store digital data in a format usable by a particular electronic 
device. 

43 Based on my training, experience, and research, I know that the Target 
Devices have capabilities that allow them to serve as a wireless telephone, digital camera, 
memory storage, and may also function as a computer and internet browser. In my training and 
experience, examining data stored on devices of this type can uncover, among other things, 
evidence that reveals or suggests who possessed or used the device. 

ELECTRONIC STORAGE AND FORENSIC ANALYSIS 

44. The applied-for warrant would authorize the forensic examination of the 
Target Devices for the purpose of identifying and seizing the electronically stored information 
particularly described in Attachment B in accordance with Federal Criminal Procedure Rule 
41(e)(2)(B) (“Warrant Seeking Electronically Stored Information”). 

45. Forensic evidence-. As further described in Attachment B, this application 
seeks permission to locate not only electronically stored information that might serve as direct 
evidence of the crimes described on the warrant, but also forensic evidence that establishes how 
the Target Devices were used, the purpose of their use, who used them, and when. There is 
probable cause to believe that this forensic electronic evidence more likely than not is stored in 
the Target Devices because: 


a. Data on a storage medium can provide evidence of information 

that was once on the storage medium but has since been deleted or 
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edited, or of a deleted portion of the information. 

b. Forensic evidence stored within the Target Devices can also 
indicate who has used or controlled the Target Devices. This 
“user attribution” evidence is analogous to the search for “indicia 
of occupancy” while executing a search warrant at a residence. 

c. A person with appropriate familiarity with how the Target Devices 
works may, after examining this forensic evidence in its proper 
context, be able to draw conclusions about how electronic devices 
were used, the purpose of their use, who used them, and when. 

d. The process of identifying the exact electronically stored 
information on a storage medium that are necessary to draw an 
accurate conclusion is a dynamic process. Electronic evidence is 
not always data that can be merely reviewed by a review team and 
passed along to investigators. Whether data stored on a cellular 
telephone is evidence may depend on other information stored on 
the cellular telephone and the application of knowledge about how 
a cellular telephone operates. Therefore, contextual information 
necessary to understand other evidence also falls within the scope 
of the warrant. 

e. Further, in finding evidence of how the Target Devices was used, 
the purpose of its use, who used it, and when, sometimes it is 
necessary to establish that a particular thing is not present on a 
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storage medium. 

f. Based cfn my knowledge, training and experience, I know that 

electronic devices can store information for long periods of time. 
Similarly, things that have been viewed via the internet are 
typically stored for some period of time on the device. This 
information can sometimes be recovered with forensics tools. 

46. Nature of examination: Based on the foregoing, and consistent with Rule 
41(e)(2)(B), the warrant I am applying for would permit the examination of the Target Devices 
consistent with the warrant. The examination may require authorities to employ techniques, 
including but not limited to computer-assisted scans of the Target Devices’ entire storage, 
medium, that might expose many parts of the devices to human inspection in order to determine 
whether it is evidence described by the warrant. 

47. Manner of execution : Because this warrant seeks only permission to 
examine a cellular telephone already in law enforcement’s possession, the execution of this 
warrant does not involve the physical intrusion onto a premises. Consequently, I submit there is 
reasonable cause for the Court to authorize execution of the warrant at any time in the day or 
night. 

48. Forensic image retention'. I hereby request judicial authorization to retain 
full copy of the Devices’ storage media after the review is complete (to the extent that this 
warrant does not already authorize me to retain that storage media as seized forfeitable property) 
and until further order of the Court. That judicial authorization is justified in this case in part 
because: 
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a. Should the execution of the warrant uncover data that may later 

need to be introduced into evidence during a trial or other 

proceeding, the authenticity and the integrity of the evidence and 
=: li¬ 
the government’s forepsic methodology may be contested issues. 

Retaining copies of seized storage media can be required to prove 

these facts. 

b. Returning the original storage medium to its owner will not allow 
for the preservation of that evidence. Even routine use of a 
cellular telephone may forever change the data it contains or 
eliminate data stored on it. 

c. Because the investigation is not yet complete, it is not possible to 
predict all possible defendants against whom evidence found on 
the storage medium might be used. That evidence might be used 
against persons who have no possessory interest in the storage 
media, or against persons yet unknown. Those defendants might 
be entitled to a copy of the complete storage media in discovery. 
Retention of the entire content of the storage medium assures that 
it wiil be available to all parties, including those known now and 
those later identified. 

d. The act of destroying or returning a Device could create an 
opportunity for a defendant to claim, falsely, that the destroyed or 
returned Devices contained evidence favorable to him. 
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Maintaining a copy of the Devices’storage medium would permit 
the government, through an additional warrant if necessary, to 
investigate such a claim. 

e. Similarly, should a defendant suggest an explanation for the 

presence of evidence on a storage medium, it may be necessary to 
investigate such an explanation by, among other things, 
re-examining the storage medium with that defense in mind. This 
may require an additional examination of the storage medium for 
evidence that is described in Attachment B but was not properly 
identified and segregated previously. 

CONCLUSION 

49. Based on my training and experience, and the facts as set forth in this affidavit, 
there is probable cause to believe that on the following Devices, as set forth in paragraph 2 
above: 

a SILVER SONY CYBERSHOT CAMERA, MODEL #DSC-S700, S/N 0522961, 
further identified in Attachment A, for the information identified in Attachment B. 

There exists fruits, evidence, and instrumentalities of violations of Title 18, 
United States Code (USC), Section 1029(a)(5) (Fraud and Related Activity in Connection with 
Access Devices )(FRACAD); Title 18, United States Code, Section 1201 (Kidnapping); and 
Title 18, United States Code, Section 1202(b) (Ransom Money). 

50. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. 18 U.S.C. §§ 2703(a), (b)(1)(A) & 





(c)(1)(A). Specifically, the Court is “a district court of the United States ... that - has 
jurisdiction over the offense being investigated.” 18 U.S.C, § 2711(3)(A)(I). 

51. The investigation of this case is ongoing and disclosure of the issuance of the 

search warrant could result in destruction of evidence and could also impact officer, witness and 
victim safety. Accordingly, pursuant to the case law outlined in the government s motion to 
seal, I respectfully request that the search warrant, search warrant affidavit, attachments, and 
returns be sealed. 


Further your Affiant sayeth naught. 

/s/ Signature Redacted 

special Ageni joiene vjoeden 
Federal Bureau of Investigation 


SUBSCRIBED and SWORN to before me 
" ?: “thl|. .a2 J ^ day 6f ^d,gqftal , 2012. 

D. Roberts, USMJ 

ljStb " " — L - • b Redacted' 


,^i^iajsa,bi^es|iviagisira 
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IN THE MATTER OF THE SEARCH OF SILVER SONY CYBERSHOT CAMERA, 

MODEL #DSC-S700, S/N 0522961, CURRENTLY LOCATED AT FBI ANCHORAGE NON¬ 
DRUG EVIDENCE LOCKER 26 




KAREN L. LOEFFLER 
United States Attorney 

CRAIG M. WARNER 

Assistant U.S. Attorney 

Federal Building & U.S. Courthouse 

222 West Seventh Avenue, #9, Room 253 

Anchorage, Alaska 99513-7567 

Phone: (907) 271-5071 

Fax: (907) 271-1500 

E-mail: craig.wamer@usdoj.gov 


IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF ALASKA 


In the Matter of the Search of: 

SILVER SONY CYBERSHOT 
CAMERA, MODEL #DSC-S700, S/N 
0522961 


) Case No.3:12-MI-00139-JDR 

) MOTION TO SEAL SEARCH 
) WARRANT, APPLICATION, 

) AFFIDAVIT FOR SEARCH 
) WARRANT, ATTACHMENTS, 
) AND RETURN 
) 

) FILED UNDER SEAL 


COMES NOW the United States of America,- by and through undersigned 


counsel and hereby moves for an order sealing the Search Warrant, Application 
and Affidavit and Returns for the search warrant issued in the above-captioned 


matter until further order of this Court. 

The government makes this motion to protect the investigative integrity of 
the present case. The investigation of-this case is ongoing and disclosure of the 




issuance of the search warrant could result in destruction of evidence and could 


also impact officer, witness and victim safety. 

Historically, courts have recognized a “general right to inspect and copy 
public records and documents, including judicial records and documents.” 
Kamakana v. City and Countv of Honolulu. 447 F.3d 1172, 1178 (9th Cir. 2006) 
citing Nixon v. Warner Communications. Inc.. 435 U.S. 589, 597 & n.7 (1978). 
Nonetheless, access to judicial records is not absolute. A narrow range of 
documents is not subject to the right of public access at all because the records 
have “traditionally been kept secret for important policy reasons.” Id. citing 
Times Mirror Co. V. United States. 873 F.2d 1210, 1219 (9th Cir. 1989). Ninth 
Circuit case law has identified two categories of documents that fall into this 
category: grand jury transcripts and warrant materials in the midst of a pre- 
indictment investigation. Id. Parties seeking to seal a judicial record not 
traditionally kept secret must provide compelling reasons to the court for doing so. 
Id. In general, “compelling reasons” are those sufficient to outweigh the public’s 
interest in disclosure. Mi at 1179. 

Based on the foregoing, the government respectfully requests this Court 

IN THE MATTER OF THE SEARCH OF SILVER SONY CYBERSHOT CAMERA, 
MODEL #DSC-S700, S/N 0522961, CURRENTLY LOCATED AT FBI 
ANCHORAGE NON-DRUG EVIDENCE LOCKER 
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enter the attached proposed Order sealing said search warrant, Application and 
Affidavit for Search Warrant, the Returns and this Motion and Order until said 
time as the government has time to review the information contained therein and 
act upon. 

RESPECTFULLY SUBMITTED this 22th day of March, 2012, in 
Anchorage, Alaska. 


kar&tc. LOEFFLER 7 

i /S I Signature Redacts 1st Signature Redacted 

s/ Crai^ M. Warner _ 

Assistant U.S. Attorney 

Federal Building & U.S. Courthouse 

■222 West Seventh Avenue, #9, Room 253 

Anchorage, Alaska 99513 

Phone: (907) 271-5071 

Fax:(907) 271-1500 

E-mail: craig.wamer@usdoj.gov 


IN THE MATTER OF THE SEARCH OF SAMSUNG CELLULAR TELEPHONE, 
BLACK IN COLOR, SLIDER TYPE, Model# SCH-R631. Possible S/N 80015743, 
CURRENTLY LOCATED AT FBI ANCHORAGE NON-DRUG EVIDENCE LOCKER 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF ALASKA 


In the Matter of the Search of: 

SILVER SONY CYBERSHOT 
CAMERA, MODEL #DSC-S700, S/N 
0522961 


) Case No.3:12-MJ-00139-JDR 

) 

) ORDER GRANTING MOTION 
) TO SEAL SEARCH WARRANT, 
) APPLICATION, AFFIDAVIT 
) FOR SEARCH WARRANT, 

) ATTACHMENTS AND 
) RETURN 
) 

) FILED UNDER SEAL 


The United States requests that the Search Warrant, Application, Affidavit, 
Attachments and the Return filed in the above-captioned case be sealed. 

This Court finds that the need for secrecy to protect the ongoing 
investigation and potential witnesses outweighs the public’s right to inspect and 


copy judicial records and documents. 

IT IS HEREBY ORDERED that: 

The Search Warrant, Application, Affidavit and Attachments filed in the 
above-captioned case, and the Return to be filed, be sealed until further order of 


this Court. 


Further, the United States Attorney’s Office is directed to notify the Court 
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as soon as the need for secrecy passes by filing a motion to unseal records. 
DATED this 22nd day of March, 2012, at Anchoragj^aska, • - v: 

/s/John D. Roberts, USMJ .f"' 

C~ Signature Redacted ~—rfb— 

\gyniN u. Kucjajtc i a _ 


United States Magistrate Judge 
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<jt c AO 93 (Rev, i 2/03) Search WaiTant 


United States District Court 

_ District of _ Ataska 


In the Matter of the Search of 

(Name, address or brief description of person or property to be searched) 

SEARCH WARRANT 

Black Sandisk M250 MP3 Player, 2GB 


Case Number: 3:12-mj-000140-JDR 


TO: _ S/A Joiene Goeden, FBI _and any Authorized Officer of the United States 

Affidavit(s) having been made before me by _ S/A Joiene Goeden, FBI _who has reason to believe 

Affiant 

that □□ on the person of, or 0[k>n the premises known as (name, description and/or location) 

See Attachment A, which is incorporated by reference, 


in the _District of _ Aiaska _there is now 

concealed a certain person or property, namely (describe the person or property) 

See Attachment B, which is incorporated by reference. 


I am satisfied that the affidavit(s) and any record testimony establish probable cause to believe that the person or property so described 
is now concealed on the person or premises above-described and establish grounds for the issuance of this warrant. 

YOU ARE HEREBY COMMANDED to search on or before _ 4/1/2012 _ ; _ 

Date 

(not to exceed 10 days) the person or place named above for the person or property specified, serving this warrant and making the 
search 0 in the daytime— 6:00 AM to 10:00 P.M. □ at anytime in the day or night as I find reasonable cause has been 
established and if the person or property be found there to seize same, leaving a copy of this warrant and receipt for the person 
or property taken, and prepare a written inventory of the person or property seized and promptly return this warrant to 

_ TT - RoV^e.rK _as required by law. 

U.S. Magistrate Judge (Rule 41(f)(4)) 




Date and Time Issued 




JOHN D. ROBERTS 

U.S. MAGISTRATE JUDGE 




vCityvansESjate' 

•2' /s/John D. Roberts, USMJ 

Signature Redacted._ . 

















ATTACHMENT A 


The property to be searched is a Sandisk M250 MP3 Player, black in color, 2GB, 
currently located at the FBI building at 101 E. 6 th Ave., Anchorage, Alaska, in the non-drug 
evidence locker. ^ 






ATTACHMENT B 


All records and information on the Target Device identified in Attachment A that relate to 
violations of Title 18, United States Code (USC), Section 1029(a)(5) (Fraud and Related Activity 
in Connection with Access Devices )(FRACAD); Title 18, United States Code, Section 1201 
(Kidnapping); and Title 18, United States Code, Section 1202(b) (Ransom Money), and involve 
ISRAEL KEYES since October 1, 2011, including: 


1. Evidence of who used, owned, or controlled the Target Device, including logs, 
registry entries, configuration files, saved usernames and passwords, and 
documents. 

2. Evidence of the times the Target Device was used. 

3. Passwords, encryption keys, and other access devices that may be necessary to 
access the Target Device . 

4. Evidence of digital photographs and “metadata” associated with such photos, 
including geographic and/or Global Positioning System (GPS) data indicating the 
physical location at which the photograph was taken, date and time stamps 
indicating the date and time of day the photograph was taken, and data indicating 
the identity of other electronic devices to which or from which photographs were 
uploaded, downloaded or otherwise transferred or copied, and when such transfers 
took place. 

5. Evidence of audio or video recordings, and “metadata” associated with such audio 
and video recordings, including geographic and/or Global Positioning System 
(GPS) data indicating the physical location at which the photograph was taken, 
date and time stamps indicating the date and time of day the photograph was 
taken, and data indicating the identity of other electronic devices to which or from 
which photographs were uploaded, downloaded or otherwise transferred or 
copied, and when such transfers took place. 

6. Evidence of documents or other computer files downloaded to the Device from 
computers, cellular telephones and digital cameras. 

7. Contextual information necessary to understand the evidence described in this 
attachment. 


As used above, the terms “records” and “information” include all of the foregoing items 
of evidence in whatever form and by whatever means they may have been created or stored, 
including any form of computer or electronic storage. - 






# 

AO 106 (Rev. 04/10) Application for a Search WarTant^^ 




United States District Court 

for the 

District of Alaska 


In the Matter of the Search of 
(Briefly describe the property to be searched 
or identify the person by name and address) 

Black Sandisk M250 MP3 Player, 2GB 


Case No. 3:12-mj-000140-JDR 


APPLICATION FOR A SEARCH WARRANT 

1, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 

Is i n co rpSrated herein by reference 


located in the _ District of_ Alaska _, there is now concealed (identify the 

person or describe the property to be seized)'. 

See Attachment B, which is incorporated herein by reference 


The basis for the search under Fed. R.Crim. P. 41(c) is (check one or more): 
evidence of a crime; 

□ contraband, fruits of crime, or other items illegally possessed; 

d property designed for use, intended for use, or used in committing a crime; 

□ a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section 
18U.S.C. 1029(a)(5) 
18U.S.C. 1201 
18 U.S.C. 1202(b) 


Access Device Fraud 
Kidnapping 
Ransom Money 


Offense Description 


The application is based on these facts: 

See Attached Affidavit, which is incorporated herein by reference 


sf Continued on the attached sheet, 

□ Delayed notice of_days (give exact ending date if more than 30 days:_) is requested 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Sworn to before me and signed in my presence. 
Date: 03/22/2012 


isl Signature Redacted 


Joiene Goeden, FBI Special Agent 


Printed name and title 
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ATTACHMENT B 


All records and information on the Target Device identified in Attachment A that relate to 
violations of Title 18, United States Code (USC), Section 1029(a)(5) (Fraud and Related Activity 
in Connection with Access Devices )(FRACAD); Title 18, United States Code, Section 1201 
(Kidnapping); and Title 18, United States Code, Section 1202(b) (Ransom Money), and involve 
ISRAEL KEYES since October 1,2011, including: 


1. Evidence of who used, owned, or controlled the Target Device, including logs, 
registry entries, configuration files, saved usernames and passwords, and 
documents. 

2. Evidence of the times the Target Device was used. 

3. Passwords, encryption keys, and other access devices that may be necessary to 
access the Target Device . 

4. Evidence of digital photographs and “metadata” associated with such photos, 
including geographic and/or Global Positioning System (GPS) data indicating the 
physical location at which the photograph was taken, date and time stamps 
indicating the date and time of day the photograph was taken, and data indicating 
the identity of other electronic devices to which or from which photographs were 
uploaded, downloaded or otherwise transferred or copied, and when such transfers 
took place. 

5. Evidence of audio or video recordings, and “metadata” associated with such audio 
and video recordings, including geographic and/or Global Positioning System 
(GPS) data indicating the physical location at which the photograph was taken, 
date and time stamps indicating the date and time of day the photograph was 
taken, and data indicating the identity of other electronic devices to which or from 
which photographs were uploaded, downloaded or otherwise transferred or 
copied, and when such transfers took place. 

6. Evidence of documents or other computer files downloaded to the Device from 
computers, cellular telephones and digital cameras. 

7. Contextual information necessary to understand the evidence described in this 
attachment. 

As used above, the terms “records” and “information” include all of the foregoing items 
of evidence in whatever form and by whatever means they may have been created or stored, 
including any form of computer or electronic storage. 
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UNITED STATES DISTRICT COURT 
THE DISTRICT OF ALASKA 


) 

IN THE MATTER OF THE SEARCH OF ) Case No. 3:12-mj-00140-JDR 

) 

BLACK SANDISK M250 MP3 PLAYER, 2GB ) 

) 

) 

) 

) 

_ ) 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 

I, Jolene Goeden, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 

1. I am a Special Agent of the Federal Bureau of Investigation (FBI). I have been a 
Special Agent of the FBI since April 2004. I am charged with the duty of investigating violations 
of the laws of the United States, collecting evidence in cases in which the United States is or may 
be a party in interest, and performing other duties imposed by law. I have been assigned to 
investigate most criminal matters within the jurisdiction of the FBI, including kidnapping 
matters, fraud matters and other white collar crime. 

2. I make this affidavit in support of an application under Rule 41 of the Federal Rules of 
Criminal Procedure for a warrant to search five electronic items seized during a common set of 
searches and pursuant to a common set of circumstances, as outlined below : 

BLACK SANDISK M250 MP3 PLAYER, 2GB, further identified in Attachment 
A, for the information-identified in Attachment B. 
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This item is currently located at FBI Anchorage at 101 East Sixth Avenue, Anchorage, 
Alaska, in the secure, non-drug evidence vault. 

3. As set forth herein, there is probable cause to believe that in the property to be searched 
there exists evidence of a crime, contraband, fruits of a crimes, or other items illegally possessed 
in violation of Title 18, United States Code (USC), Section 1029(a)(5) (Fraud and Related 
Activity in Connection with Access Devices )(FRACAD); Title 18, United States Code, Section 
1201 (Kidnapping); and Title 18, United States Code, Section 1202(b) (Ransom Money), as 
farther described in Attachment A. . 

RELEVANT STATUTES 

4. The Target Device contains evidence of and is an instrumentality used for 
violations of Title 18, USC, Section 1029(a)(5), Fraud and Related Activity in Connection with 
Access Devices, which provides that: 

Whoever, knowingly and with intent to defraud effects transactions with 1 or more access 
devices issued to another person or persons, to receive payment or any other things of 
value during any 1-year period that aggregate value of which is equal to or greater than 
$ 1 , 000 ; 


and Title 18, United Slates Cd4e, Section 1201 (Kidnaping), which provides that: 

Whoever unlawfully seizes, confines, inveigles, decoys, kidnaps, abducts, or carries away 
and holds for ransom of reward or otherwise any person, except in the case of a minor by 
the parent thereof, -when the person is willfully transported in interstate or foreign 
commerce, regardless of whether the person was alive when transported in interstate or 
foreign commerce or uses the mail or any means, facility, or instrumentality of interstate 
or foreign commerce in committing or in furtherance of the commission of the offense; 


and Title 18, United States Code, Section 1202(b) (Ransom Money), which provides that:. 

Whoever receives, possesses, or disposes of any money or other property, or any portion 
thereof, which has at any time been delivered as ransom or reward in connection with a 
violation of section 1201 of this title, knowing the same to be money or property which 
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has been at any time delivered as such ransom or reward. 


6. The applied for warrant would authorize the forensic examination of the devices listed 
above in paragraph 2, and further identified in Attachment A, for the purpose of identifying 
electronically stored data particularly described in Attachment B. 

PROBABLE CAUSE 

7. The information contained below is from my personal knowledge and experience, 
information provided to me by other law enforcement personnel, or from those specific sources 
as set forth. Since this affidavit is being submitted for the limited purpose of seeking 
authorization to search the Devices listed in paragraph 2 above, I have not included each and 
every fact known to me regarding this investigation. I have set forth only the facts that I believe 
are necessary to establish a foundation to support the aforementioned request for a search 
warrant. 

Abduction of S.K. 

8. On 2-2-12 at about 12:39 Alaska Standard Time (AST), Duncan, the owner of the 
Common Ground Coffee stand at 630 E. Tudor, Anchorage, Alaska, contacted APD dispatch. 
Duncan was calling from Oregon, where he was vacationing. He reported that while viewing his 
internet-based security system he saw one of his employees, 18-year-old S.K., appear to be 
abducted. Duncan said he was contacted by S.K.’s father (J.K.) and boyfriend (D.T.), who had 
been unable to locate her. This contact prompted Duncan to review his security video which 
showed an unknown man climb through the window of the coffee stand at about 20:00 AST on 
2-1-12 while S.K. was working. The video appears to show S.K. retreating a short distance and 
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raising her hands in an apparent sign of submission to the man who subsequently climbed into 
the coffee stand, robbed S.K. and escorted her away from the scene. The abductor climbed 
through the window into the coffee stand without any significant difficulty. He appeared to be 
significantly taller than S.K., who is 5'4 M tall, but due to the limited lighting and quality of the 
video, a more accurate estimate of his height has not been made. The robber/abductor appeared 
to have a medium to large build and athletic movements. 

9. At the time of her abduction, S.K. was wearing a dark-colored jacket, a green 
shirt with light-colored stripes on the sleeves, a thin dark-colored bracelet, dark-colored pants, 
and dark-colored shoes. At the time of her abduction, S.K. was also believed to be in possession 
of a carabineer with three keys and possibly a white lanyard, a medium-to-large size leopard 
print purse, and a black cellular telephone with sliding keyboard. S.K. is a white female adult, 
approximately 5'4" tall, 150 pounds, 18 years old, with shoulder-length brown hair and brown 
eyes. 

10. Video surveillance appeared to show S.K.'s robber/abductor wearing a dark- 
colored, possibly hooded, jacket, dark-colored glasses, a dark-colored face mask, dark-colored 
gloves, dark-colored pants; and dark-colored shoes. He appeared to be carrying a white coffee 
cup and a dark-colored bag. Although to date no weapon has been conclusively identified in the 
surveillance videos that captured this robbery/abduction, the scene was generally poorly lit and 
the robber/abductor was not always fully visible. Furthermore, S.K.'s reaction appeared to be 
consistent with someone who was confronted or threatened with a weapon, In addition, during 
separate subsequent interviews, both S.K.'s father and boyfriend adamantly indicated that S.K. 
was very strong-willed and would not have complied with a robber or abductor's demands, 
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unless she had been threatened with a weapon. 

11. Surveillance video from a nearby Home Depot at approximately 19:54 AST on 2- 
1-12 showed a white Chevrolet extended cab truck roll through the Home Depot parking lot and 
park just east of an International House of Pancakes. From a distance, the surveillance showed 
an individual with a black garment and hat get out of the truck and walk westbound through the 
parking lot towards Denali St., cross it, get on the sidewalk, walk southbound on Denali St. to 
Tudor Rd., cross Tudor Rd. at the intersection, and, finally, exit the frame. The individual’s 
travel was in the direction of the Common Ground Coffee stand, from which S.K. was abducted. 
One minute later, the video surveillance footage from Common Ground Coffee stand showed the 
individual who abducted S.K. approach from the direction of the man in the Home Depot video. 
Approximately two minutes after S.K. and her abductor exited the frame of the Common 
Ground Coffee stand video footage, two persons appearing to match S.K. and her abductor again 
entered the frame of the Home Depot video footage, this time walking back towards the location 
where the white Chevrolet truck was originally parked. The Home Depot video then showed the 
two people approach the passenger side door of the Chevrolet truck. It then showed the person 
who appeared to be S.K. enter the passenger side of truck. The other individual then walked 
around truck, entered the driver’s side, and drove out of the surveillance video’s frame. As 
described below, police have now identified KEYES’ residence and located a white Chevrolet 
truck registered to him at that residence. This white Chevrolet truck belonging to KEYES 
appears to match the vehicle in the Home Depot surveillance footage, although KEYES’ truck 
has several toolboxes and a ladder rack fastened with removable bolts to the truck bed, and these 
items do not appear on the truck in the Home Depot video. 
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12. During an interview on 02-02-2012, D.T. (S.K.’s boyfriend) said he went to the 
coffee stand on 2-1-12 at about 20:33 AST to give her a ride home but the stand appeared to be 
dosed and she was not there. D.T, further reported to law enforcement that on 02/02/2012, at 
approximately 03:00 AST, he observed an unknown male adult wearing a ski mask and dark 
clothing going through the vehicle he shared with S.K. D.T. did not alert authorities to the 
burglary of the vehicle at that time, 

13. When D.T. was asked where his ATM debit card was by APD Detectives several 
days after the abduction, he indicated he had left it in the vehicle he shared with S.K. This 
vehicle had been seized by APD on 02-02-2012 and searched pursuant to a State of Alaska 
search warrant. The debit card referenced above was not located during the search; however law 
enforcement did not notify D.T. of this fact. D.T. indicated that his debit card was a Credit 
Union 1 VISA debit card (VISA debit card) bearing XXXXXXXXXXXX2851, expiration 
01/15, and that he did not give his VISA debit card to anyone else or give anyone permission to 
use it. The card is thus believed to have been stolen from D.T.’s vehicle at the time D.T. 
observed the vehicle break-in. D.T. further related that S.K.’s driver’s license had also been in 
his vehicle. That driver’s license was missing when searched for on 02-02-2012, indicating that 
it also was stolen at that tiit-tf. I know that a driver’s license is generally necessary to leave the 
State of Alaska by airplane, road or ferry, due to established interstate (or international in the 
case of travel to/from Alaska via the Alaska-Canada Highway) travel requirements. 
Furthermore, due to Alaska’s unique geographic location, the difficulty of traveling by road 
through northern Canada in winter, and the lengthy periods generally associated with traveling 
to/from Alaska by ferry, commercial airlines are the most common and popular mode of 
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interstate travel to/from Alaska, especially during the winter. 

Ransom Note and Transfer of Funds to “Ransom Account” 

14. On 02-24-2012, at 19:56 AST, D.T. received the following text on his cell phone 
907-231-9835 from S.K.’s cell phone 907-884-8370 - “Conner park sign under pic of albert aint 
she purty”. J.K. (S.K.’s father) contacted law enforcement officers and relayed the information. 
At the request of APD Detectives, at approximately 20:18 AST, APD Patrol Officers arrived at 
Conner Park located on the southeast comer of Jewel Lake Road and International Airport Road 
in Anchorage, Alaska. J.K.and D.T. were already present. Attached to the park sign, below a 
flyer for a lost dog named “Albert,” was a ziploc bag which contained a folded piece of paper. 

15. On one side of the piece of paper, there was a photograph of S.K. with silver duct 
tape around her mouth and chin. She appeared to be wearing eye liner, and a light-colored, 
latex-gloved hand and lightly complected, muscular arm was holding SX's hair. In the upper 
part of the photo was an Anchorage Daily Newspaper determined to be the issue released on 
Monday, February 13, 2012. 

16. On the reverse side of the piece of paper was a ransom note which demanded 
$30,000. The note included the 16-digit card number of the debit card belonging to D.T., which 
he had reported stolen on the night of the kidnaping, as summarized above. This debit card 
number is correlated to a bank account number held by D.T. and S.K. The note demanded that 
$30,000.00 be deposited into that account and indicated that the writer of the note intended to 
withdraw money at regular intervals over the coming days, and in locations other than Alaska. 
Specifically, it said, “I may not use the card much in ak due to small pop but as I will be leaving 
soon I will be using it all over.” The note further gave an indication that S.K. had been moved 
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from Alaska, stating that “she did almost get away twice, once on tudor and once in the desert, 
must be losing my touch.” I know from research, training, and experience, and discussions with 
law enforcement officers familiar with Alaska that there are no areas in Alaska commonly 
referred to and known to be “deserts.” Many such areas do exist in Arizona, New Mexico and 
Texas. Subsequent analysis of the demand note by the FBI Laboratory revealed that it was typed 
with a typewriter that used a carbon ribbon, and that the aforementioned picture on the back of 
the demand note was printed with an inkjet printer. 

17. On 02-29-2012, at approximately 16:55 AST, J.K. contacted APD Detectives and 
told them he was withdrawing $5,000.00 from the reward account set up for S.K. at Denali 
Alaskan Federal Credit Union, and he intended to deposit it in the ransom fund, which was an 
account held by Credit Union 1. Pursuant to a State search warrant obtained by APD Detective 
Joseph Barth on 02-25-2012, investigators were informed that $5,000.00 was deposited in the 
Credit Union 1 account indicated on the ransom note, (the account attached to the Credit Union 

1 VISA debit card [VISA debit card] bearing XXXXXXXXXXXX2851, expiration 01/15 issued 
to D.T).at 17:45 AST on 02-29-2012). 

Unauthorized use of Credit Union 1 VISA debit card 

18. On 02-29-2012 at 22:13 AST, an unknown person utilizing D.T.’s Credit Union 1 
debit card attempted to withdraw $600.00 in US Currency from the account indicated on the 
ransom note. The attempted withdrawal took place at the Automatic Teller Machine (ATM) 
located at the Alaska USA'bank at 4000 Credit Union Drive in Anchorage, Alaska. Because the 
attempted amount was over the $500.00 daily limit, the withdrawal was declined. Surveillance 
video in the area of the ATM revealed a male dressed in a black hooded sweatshirt and black 
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pants, operating a light-colored SUV, arrived in the parking lot of the Sea Galley restaurant 
across the street. After parking the SUV, the male exited and quickly walked across the street to 
the area of the Alaska USA ATM. The SUV was later determined by the FBI to be a silver 
Nissan Xterra of a model between the years 2005 and 2012. As noted below, police have now 
determined that KEYES' girlfriend owns a silver 2007 Nissan Xterra. 

19. On 02-29-2012 at 23:56 AST, $500.00 in US Currency was withdrawn from the 
ATM at the Denali Alaskan Federal Credit Union located at 3020 Minnesota Drive in 
Anchorage, Alaska. The debit card utilized to withdraw the money was the same Credit Union 1 
debit card issued to D.T. Surveillance video obtained of the area revealed this withdrawal was 
conducted by an unknown male with a muscular appearance wearing a dark-colored, possibly 
hooded, jacket with a light-colored design or paint spatter on the left chest and front, and light- 
colored lettering, including possibly "CORPS" across the back shoulders; clear or light-colored 
glasses; a gray face mask; gray gloves; dark-colored pants; and light-colored shoes. 

20. During the course of the investigation, Detective Blanton and Officer Pierce of 
APD obtained surveillance footage from businesses surrounding the Alaska USA, which is 
located on Credit Union Drive in Anchorage, Alaska. Immediately before the withdrawal, a 
hidden surveillance camera located at the Sea Galley at 4101 Credit Union Drive in Anchorage, 
Alaska captured a similarly dressed male park in the extreme southwest comer of the Sea Galley 
parking lot driving a silver Nissan Xterra. From the surveillance video, the male appeared to 
exit the vehicle and walk westbound across the street to the Alaska USA and return a short while 
later. Both the male’s appearance and timing are commensurate with him being the person who 
attempted to withdraw the money. 
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21. On 03-01-2012 at approximately 00:28 AST, $500.00 in US currency was 
withdrawn from the ATM at the Alaska USA located at 7701 Debarr Road in Anchorage, 

Alaska. As with the prior two transactions, the debit card utilized to withdraw the money was 

the Credit Union 1 debit card issued to D.T. 

22. On 03-07-2012 at approximately 21:57 AST, $400.00 in US currency was 
withdrawn from the ATM at the Western Bank located at 200 West Rex Allen Road in Willcox, 
Arizona. The debit card utilized to withdraw the money was the Credit Union 1 debit card 
issued to D.T. Surveillance video on the ATM showed the individual using the debit card for 
the withdrawal was a white male dressed in a gray hooded jacket or sweatshirt, glasses, a gray 
face mask, gray gloves, dark-colored pants, and light-colored shoes, and appeared to be driving a 
late model white Ford Focus sedan. 

23. On 03-07-2012 at approximately 23:24 AST, there was an attempted $400.00 
withdrawal at the Western Bank located at 711 Main Street in Lordsburg, New Mexico, using 
D.T.’s Credit Union 1 debit card (the same card referenced in prior paragraphs.) The withdrawal 
was declined by the ATM as it would have put the debit card over the daily withdrawal limit. 

At 23:25 AST, at the same ATM, a balance inquiry was conducted on the account utilizing the 
debit card. The balance shown was $3,598.91. At 23:26 AST, $80.00 was withdrawn from the 
account utilizing the debit card. Surveillance video on the ATM showed the individual using the 
debit card wore similar clothing to the first ATM withdrawal in Arizona. 

24. On 3-9-2012 at approximately 23:23 AST, there was a $483.00 withdrawal made 
at an ATM at Houston Community Bank, 1515 FM 1960 Bypass East, Humble City, Texas. 
Initial review of the surveillance video from the ATM appeared to show that the individual using 
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the debit card wore similar clothing to that worn during the two aforementioned ATM 
withdrawals in Arizona and New Mexico. 

25. On 03-11 -2012 at approximately 23:47 AST, there was a $480.00 withdrawal at 
the People’s State Bank located at 5850 Hwy 59 South, Shepherd, Texas using D.T.’s Credit 
Union 1 debit card (the same card referenced in prior paragraphs.) Surveillance video on the 
ATM showed the individual using the debit card wore similar clothing to the first ATM 
withdrawal in Arizona, as well as the subsequent withdrawals in New Mexico and Texas. 

Stop of the White Ford Focus. 

26. On 03/13/2012, at approximately 11:00 Central Time (CT), Texas Ranger Steven 
Rayburn, was notified by Texas Department of Public Safety (DPS) Highway Patrol Corporal 
Bryan Henry (Corporal Henry) that a white Ford Focus sedan bearing Texas license plate 
DH4N930 was observed parked at the Quality Inn & Suites (QIS), 4306 South First Street, 
Lufkin, Texas, which is a short drive from Shepherd, Texas. 

27. On 03/13/2012, at approximately 11:15 CT, Ranger Rayburn responded to the 
QIS, at which time FBI Agent Deb Gannoway conducted a walk-by and visual inspection of the 
white Ford Focus. Gannoway noted a bar-code sticker on the driver's side back passenger 
window consistent with stickers applied to rental vehicles. She also noted numerous items of 
clothing, trash and other debris in plain sight within the vehicle, including what appeared to be a 
girl's or woman's pink item of clothing. Ranger Rayburn caused a Texas license plate database 
search to be conducted which revealed the white 2012 Ford Focus was registered to P.V Holding 
Corporation, 9603 John Saunders Road, San Antonio, Texas. DPS Criminal Investigative 
Division (CID) Lieutenant Mickey Hadnot (Lieutenant Hadnot) maintained surveillance on the 
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Ford Focus. 


28. On 03/13/2012, at approximately 11:30 CT, Lieutenant Hadnot reported to 
Ranger Rayburn, that a white male adult exited room 215 of the QIS, placed some items into the 
trunk of the aforementioned white Ford Focus, and departed the scene alone, driving the white 
Ford Focus. FBI Agent Deb Gannoway had previously obtained from the QIS front desk 
manager an "in house list" of all occupants of the QIS on the night of 03/12/2012, which 
reflected room 215 was rented by ELIJAH KEYES for the time period 03/09/2012 through 
03/13/2012. 

29. On 03/13/2012, at approximately 11:45 CT, Corporal Henry conducted a traffic 
stop on the white Ford Focus sedan based in part on FBI Agent Deb Gannoway’s suspicion that 
the vehicle was the same vehicle used in the Arizona, New Mexico, and Texas ATM 
withdrawals, as well as Corporal Henry's assessment that the driver of the vehicle was traveling 
in excess of the posted speed limit. Corporal Henry provided to FBI Agent Deb Gannoway 
Alaska Driver's License number 7268639, in the name of ISRAEL KEYES, which KEYES had 
provided to Corporal Henry. KEYES informed Corporal Henry he flew from Anchorage, 

Alaska, to Las Vegas, Nevada, on 03/07/2012, and that he rented the white Ford Focus at the Las 
Vegas airport, driving to his present location over the course of the ensuing week. KEYES 
provided to law enforcement officers a copy of his car rental agreement, which corroborated his 
statement that he had rented the car at the Las Vegas, Nevada, airport on 03/07/2012. KEYES 
was unable to describe to law enforcement officers the route he drove from Nevada to Texas, but 
stated he was in Lufkin, Texas, to attend his sister’s wedding in Wells, Texas. KEYES told 
officers he "probably" paid for fuel throughout his travels from Nevada to Texas with cash. 
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Ranger Rayburn observed that there was a pair of large white tennis shoes partially pushed under 
the driver’s seat of the Ford Focus, which Ranger Rayburn could plainly see through the window. 
During questioning by FBI Agent Gannoway and Ranger Rayburn, KEYES became increasingly 
agitated and uncooperative, and he refused to allow Ranger Rayburn to inspect his wallet (which 
was in his pocket) or his vehicle. KEYES became unusually nervous and began to sweat 
profusely, in spite of the slightly cool weather and the tank top which he was wearing at the 
time. KEYES expressed that if he was going to be kept in the area for a longer period of time, 
he desired to call his brother (who has KEYES' daughter in a separate car) and notify him of 
same. Officers suggested KEYES make that call. A short time later, the 2012 Ford Focus was 
transported to and secured at the Lufkin, Texas, Police Department. 

30. Based on the aforementioned observations, including the fact that the rented Ford 
Focus matched the description of the vehicle utilized in the ATM withdrawals in Arizona, New 
Mexico and Texas, KEYES' arrival in Las Vegas, Nevada, and his subsequent travel from 
Nevada to Texas very likely resulting in KEYES traveling through Arizona on or about 
03/07/2012 (the date of a $400.00 ATM withdrawal in Arizona) and New Mexico on or about 
03/08/2012 (the date of an $80.00 ATM withdrawal in New Mexico), KEYES' appearance 
closely matching the description of the white male adult observed in videos of the above- 
described ATM withdrawals, KEYES' own admission that he lived in the Anchorage, Alaska, 
area, KEYES' Alaska driver's license reflecting an Anchorage, Alaska, address, the white tennis 
shoes under the driver's seat matching the description of the shoes worn by the white male adult 
observed in the videos of the above-described ATM, as well as other observations, Corporal 
Henry placed KEYES under arrest. Ranger Rayburn searched KEYES’ wallet, revealing a VISA 





ATM/Debit card bearing account number XXXXXXXXXXXX2851, expiration date 01/15, in 
the name of D.T. This card is linked to the “ransom account” identified above, from which the 
withdrawals and attempted withdrawals summarized above were made. The search of KEYES 
pursuant to his arrest also revealed an AT&T Pantech flip cellular phone, blue and silver in 
color. Model #P2000, S/N 110301023456. 

Discovery of KEYES’ White Chevrolet Truck 

31. APD Detectives discovered that ISRAEL KEYES listed a mailing address of 
3705 Arctic Blvd. #2891 in Anchorage, Alaska, on 07-18-2011, which is the Mail Cache. APD 
Detectives also discovered that KEYES listed a residential address of2456 Spurr Lane in 
Anchorage, Alaska, as of 07-18-2011. 

32. On 03-13-2012 at approximately 10:30 AST, members of the APD Special 
Assignment Unit went to KEYES’ home address at 2456 Spurr Lane in Anchorage, Alaska. No 
one answered repeated knocks on the door. Per APD Sergeant Redick, there were fresh tire 
impressions in the snow in the driveway of the address that appeared as if a vehicle had been 
parked there as recently as the morning of 03-13-2012. 

33. There was also a white Chevrolet pickup truck parked in the driveway of the 
address. The truck had a large toolbox in the bed and a ladder rack on top. The bolts securing 
those items were removable and appeared to have been recently added. The license plate on the 
truck was Alaska license plate FTC990, relating to a white 2004 Chevrolet Silverado, registered 
to ISRAEL KEYES at 2456 Spurr Lane in Anchorage, Alaska. The white Chevrolet truck 
appeared to match the vehicle appearing in the Home Depot surveillance video, as summarized 
above. Further, Detectives eventually contacted KEYES’ girlfriend and discovered that she 
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drives a 2007 Nissan Xterra, which matched the general description of the vehicle used by an 
individual who appeared to attempt to use the stolen debit card on 2-29-12, as summarized 
above. 

discovery Off KEYES’ Comnuter Use and Use of Yah oo Account 

34. KEYES' girlfriend, who also lives at his residence, was interviewed on 
approximately March 14,2012. She indicated KEYES was out of Alaska. She also indicated 
that KEYES owned a laptop computer and that his computer was not in the residence. 

35. Alaska Airlines provided travel records for KEYES pursuant to a Federal Grand 
Jury Subpoena that was issued to them on March 14, 2012. In reviewing the returns for this 
subpoena, travel records were found showing KEYES and his young daughter traveled to 
Houston on February 2,2012. KEYES was originally scheduled to return on February 14,2012 
but changed the ticket to return on February 17, 2012. The ticket was booked online October 1, 
2011 and an email confirmation was sent on the same date. The return ticket was changed to 
February 17,2012 and an email confirmation was sent on 2/15/2012. The notes for this 
transaction indicate the email confirmation was sent to an email address believed to belong to 
A.K., the mother of KEYES’ daughter. However, the tickets were booked using A.K.’s credit 
card. A.K.does not reside in the state of Alaska and it is likely she had to forward the email 
confirmation to KEYES so that he would know the dates/times of travel. 

• 36. In reviewing the returns for this subpoena, travel records were also found showing 
KEYES and his young daughter traveled to Las Vegas on March 6,2012 via Alaska Airlines. 
This ticket was booked online and he provided an email address with the reservation. The notes 
section of the travel records indicated the email address provided was 
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israelkeves@vahoo.com . The records also indicated an email confirmation was sent to 
israelkeves@vahoo.com on March 1, 2012. 

Execution of Search Warrant and Discovery of Cellular Telephone Matching 
Description of Phone Belonging to S.K. and Other Cellular Telephones and Digital Media 
Devices 

37. On March 16,2012, law enforcement agents in Beaumont, Texas obtained a search 
warrant which authorized the search of the white Ford Focus driven by KEYES. Execution of 
that search warrant on March 17,2012 revealed numerous items, including a Samsung 
cellphone, black in color, slider type. Model# SCH-R631. Possible S/N 80015743 (this number 
is on the back of the phone but it does not indicate it as a S/N), which matched the description of 
S.K.’s cellular phone provided by S.K.’s boyfriend (per paragraph 9, S.K. is believed to have 
been carrying the phone when the kidnapping took place), a laptop computer; a DVD case; a 
Sony Cybershot Camera, silver in color, Model #DSC-S700, S/N 0522961; and a SandiskM250 
MP3 Player, black in color, 2GB. The laptop computer, Samsung cellular phone, Sony 
Cybershot Camera, and Sandisk M250 MP3 player were all seized pursuant to the search of the 
vehicle. The DVD case was initially not seized, but were rather returned to KEYES mother, 
HEIDI KEYES. 

3 8. In my training and experience, I know that photos from digital cameras and 
cellular phones are frequently downloaded to computers and electronic tablets, and then printed 
or stored on media devices. I also know that cellular phones, computers, electronic tablets and 
similar devices are frequently used to arrange travel and hotel reservations, rent vehicles, and 
conduct other personal business related to traveling. I also know that computers and cellular 
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phones can be used to connect to the internet, which can be used to locate banks, ATM’s, hotels, 
maps, send email, draft documents, and communicate with others. I also know that storage 
devices for electronic information, or “thumb” drives, are often used to store such information 
for later use by computers, cellular phones and other media devices. I know that electronic 
records of all such uses of computers and similar electronic devices are retained within those 
devices and may be retrieved by forensic technicians. 

Interview of KEYES 

39, In an interview with defense counsel present on March 17,2012, KEYES admitted 
to using D.T.’s debit card at locations throughout the southwest United States. He also claimed 
that he received the debit card and the cellular telephone matching the description of S.K.’s 
telephone together in a plastic bag from an anonymous person, who left the plastic bag in his 
vehicle. Based on my training and experience, it appears very likely that the specifics of • 
KEYES’ account of the origin of his possession of the phone and debit card is not truthful; 
however, his admission that the phone and debit card are associated with each other associates 
both items with S.K., and confirms the identification of the phone as belonging to S.K. During 
the interview, KEYES also indicated that a Micro SD Card belonging to the phone matching the 
description of S.K.’s phone was located within the DVD case that had been present in the white 
Ford Focus and had been returned to KEYES mother, HEIDI KEYES, following the search of 
that vehicle. 

Consensual Seizure of T.exar 4GB Micro SD ca rd and LG Cellular Telephone 
40. Following the interview with KEYES, law enforcement officers visited KEYES 
mother, HEIDI KEYES. During this visit, officers were informed that KEYES’ daughter, L.K., 
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who had been intermittently traveling with KEYES from March 6,2012 through March 13, 
2012, was in possession of a black flip-out LG Cellular Telephone S/N 104CYHE2202705. 

L.K. indicated that she had possessed this cellular phone while traveling with KEYES and that 
he had access to it throughout their intermittent travels. Officers requested that HEIDI KEYES, 
who was supervising L.K., consent to provide the black flip-out LG Cellular Telephone S/N 
104CYHE2202705. HEIDI KEYES consented to provide the phone, and officers subsequently 
seized it. Officers also requested that she allow officers to examine the DVD case found in the 
white Ford Focus and released to her, which KEYES had indicated in his interview contained a 
Micro SD chip for the cellular phone belonging to S.K. HEIDI KEYES consented to allow an 
examination of the DVD case. Pursuant to that examination, officers discovered a Lexar 4GB 
Micro SD card that appears to fit the cellular telephone belonging to S.K. HEIDI KEYES then 
consented to provide the SD Card to officers. Officers subsequently seized the SD card. 

40. The Devices listed at paragraph 2, above, are currently in the lawful possession of 
the FBI, The Devices came into the FBI possession as outlined above. Although the FBI might 
already have the lawful authority to examine the Devices, I seek this additional warrant out of an 
abundance of caution to be certain that an examination of the Devices will comply with the 
Fourth Amendment and other applicable laws. 

41. The Devices are currently in storage at FBI Anchorage Station, Anchorage, Alaska. 
In my training and experience, I know that the Devices have been stored in a manner in which 
their contents are, to the extent material to this investigation, in substantially the same state as 
they were when the Devices first came into the possession of the government. 





TECHNICAL TERMS 


42. Based on my training, my experience, and information provided to me by other 
law enforcement personnel, I use the following technical terms to convey the following 
meanings: 

a. “Storage medium”: A storage medium is any physical object upon 
which data can be stored, including a cellular telephone’s flash 
memory or other data storage components, such as a SIM card. 

b. “Wireless telephone”: A wireless telephone (or mobile telephone, 
or cellular telephone) is a handheld wireless device used for voice 
and data communication through radio signals. These telephones 
send signals through networks of transmitter/receivers, enabling 
communication with other wireless telephones or traditional “land 
line” telephones. A wireless telephone usually contains a “call 
log,” which records the telephone number, date, and time of calls 
made to and from the phone. In addition to enabling voice 
communications, wireless telephones offer a broad range of 
capabilities. These capabilities include: storing names and phone 
numbers in electronic “address books”; sending, receiving, and 
storing text messages and e-mail; taking, sending, receiving, and 
storing still photographs and moving video; storing and playing 
back audio files; storing dates, appointments, and other 
information on personal calendars; and accessing and 
downloading information from the Internet. Wireless telephones 
may also include global positioning system (“GPS”) technology 
for determining the location of the device. 

c. “Computer”: Pursuant to 18 U.S.C. § 1030(e)(1), a computer is 
“an electronic, magnetic, optical, electrochemical, or other high 
speed data processing device performing logical or storage 
functions, and includes any data storage facility or 
communications facility directly related to or operating in 

conj unction with such device. ” 

d. IP Address: An Internet Protocol address (or simply “IP Address”) 
is a unique numeric address used by computers on the Internet. 

An IP address is a series of four numbers, each in the range 0-255, 
separated by periods (e.g., 121.56.97.178). Every computer 







attached to the Internet must be assigned an IP address so that 
Internet traffic sent from and directed to that compuiter may be 
directed properly from its source to its destination. Most Internet 
service providers control a range of IP addresses. Some computers 
have static- that is, long-term - IP addresses, while other 
computers have dynamic - that is, frequently changed - IP 
addresses. 

Internet: The Internet is a global network of computers and othe 
electronic devices that communicate with each other. Due to the 
structure of the internet, connections between devices on the 
internet often cross state and international borders, even when the 
devices communicating with each other are in the same state. 


Portable media player: A portable media player (or “MP3 Player” 
or iPod) is a handheld digital storage device designed primarily to 
store and play audio, video, or photographic files. However, a 
portable media player can also store other digital data. Some 
portable media players can use removable storage media. 
Removable storage media include various types of flash memory 
cards or miniature hard drives. This removable 
storage media can also store any digital data. Depending on the 
model, a portable media player may have the ability to store very 
large amounts of electronic data and may offer additional features 
such as a calendar, contact list, clock, or games. 

Digital camera: A digital camera is a camera that records pictures 
as digital picture files, rather than by using photographic film. 
Digital cameras use a variety of fixed and removable storage 
media to store their recorded images. Images can usually be 
retrieved by connecting the camera to a computer or by connecting 
the removable storage medium to a separate reader. Removable 
storage media include various types of flash memory cards, SD 
cards or miniature hard drives. Most digital cameras also include 
a screen for viewing the stored images. This storage media can 
contain any digital data, including data unrelated to photographs or 
videos. 

Secure Digital (SD) Card: A Secure Digital (“SD”) Card is a 
removable computer memory chip for use in portable devices, 
including cellular phones, MP3 players and digital cameras. SD 




cards store digital data in a format usable by a particular electronic 
.device. 

43 Based on my training, experience, and research, I know that the Target 
Devices have capabilities that allow them to serve as a wireless telephone, digital camera, 
memory storage, and may also function as a computer and internet browser. In my training and 
experience, examining data stored on devices of this type can uncover, among other things, 
evidence that reveals or suggests who possessed or used the device,. 

ELECTRONIC STORAGE AND FORENSIC ANALYSIS 

44. The applied-for warrant would authorize the forensic examination of the 
Target Devices for the purpose of identifying and seizing the electronically stored information 
particularly described in Attachment B in accordance with Federal Criminal Procedure Rule 
41(e)(2)(B) (“Warrant Seeking Electronically Stored Information”). 

45. Forensic evidence: As further described in Attachment B, this application 
seeks permission to locate not only electronically stored information that might serve as direct 
evidence of the crimes described on the warrant, but also forensic evidence that establishes how 
the Target Devices were used, the purpose of their use, who used them, and when. There is 
probable cause to believe that this forensic electronic evidence more likely than not is stored in 
the Target Devices because: 

a. Data on a storage-medium can provide evidence of information 
that was once on the storage medium but has since been deleted or' 
edited, or of a deleted portion of the information. 

b. Forensic evidence stored within the Target Devices can also 
indicate who has used or controlled the Target Devices. This 
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“user attribution” evidence is analogous to the search for “indicia 
of occupancy” while executing a search warrant at a residence. 

c. A person with appropriate familiarity with how the Target Devices 
works may, after examining this forensic evidence in its proper 
context, be able to draw conclusions about how electronic devices 
were used, the purpose of their use, who used them, and when. 

d. The process of identifying the exact electronically stored 
information on a storage medium that are necessary to draw an 
accurate conclusion is a dynamic process. Electronic evidence is 
not always data that can be merely reviewed by a review team and 
passed along to investigators. Whether data stored on a cellular 
telephone is evidence may depend on other information stored on 
the cellular telephone and the application of knowledge about how 
a cellular telephone operates. Therefore, contextual information 
necessary to understand other evidence also falls within the scope 
of the warrant. 

e. Further, in finding evidence of how the Target Devices was used, 
the purpose of its use, who used it, and when, sometimes it is 
necessary to establish that a particular thing is not present on a 
storage medium. 

f. Based on my knowledge, training and experience, I know that 
electronic devices can store information for long periods of time. 
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Similarly, things that have been viewed via the internet are 
typically stored for some period of time on the device. This 
information can sometimes be recovered with forensics tools. 

46. Nature of examination: Based on the foregoing, and consistent with Rule 
41(e)(2)(B), the warrant I am applying for would permit the examination of the Target Devices 
consistent with the warrant. The examination may require authorities to employ techniques, 
including but not limited to computer-assisted scans of the Target Devices 1 entire storage 
medium, that might expose many parts of the devices to human inspection in order to determine 
whether it is evidence described by the warrant. 

47. Manner of execution : Because this warrant seeks only permission to 
examine a cellular telephone already in law enforcement’s possession, the execution of this 
warrant does not involve the physical intrusion onto a premises. Consequently, I submit there is 
reasonable cause for the Court to authorize execution of the warrant at any time in the day or 
night. 

48. Forensic image retention: I hereby request judicial authorization to retain 
full copy of the Devices’ storage media after the review is complete (to the extent that this 
warrant does not already authorize me to retain that storage media as seized forfeitable property) 
and until further order of the Court. That judicial authorization is justified in this case in part 
because: 

a. Should the execution of the warrant uncover data that may later 
need to be introduced into evidence during a trial or other 
proceeding, the authenticity and the integrity of the evidence and 
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the government’s forensic methodology may be contested issues. 
Retaining copies of seized storage media can be required to prove 
these facts. 

b. Returning the original storage medium to its owner will not allow 
for the preservation of that evidence. Even routine use of a 
cellular telephone may forever change the data it contains or 
eliminate data stored on it. 

c. Because the investigation is not yet complete, it is not possible to 
predict all possible defendants against whom evidence found on 
the storage medium might be used. That evidence might be used 
against persons who have no possessory interest in the storage 
media, or against persons yet unknown. Those defendants might 
be entitled to a copy of the complete storage media in discovery. 
Retention of the entire content of the storage medium assures that 
it will be available to all parties, including those known now and 
those later identified. 

d. The act of destroying or returning a Device could create an 
opportunity for a defendant to claim, falsely, that the destroyed or 
returned Devices contained evidence favorable to him. 
Maintaining a copy of the Devices’storage medium would permit 
the government, through an additional warrant if necessary, to 
investigate such a claim. 
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e. Similarly, should a defendant suggest an explanation for the 

presence of evidence on a storage medium, it may be necessary to 
investigate such an explanation by, among other things, 
re-examining the storage medium with that defense in mind. This 
may require an additional examination of the storage medium for 
evidence that is described in Attachment B but was not properly 
identified and segregated previously. 

CONCLUSION 

49. Based on my training and experience, and the facts as set forth in this affidavit, 
there is probable cause to believe that on the following Devices, as set forth in paragraph 2 
above: 

a BLACK SANDISK M250 MP3 PLAYER, 2GB, further identified in Attachment A, 
for the information identified in Attachment B. 

There exists fruits, evidence, and instrumentalities of violations of Title 18, 
United States Code (USC), Section 1029(a)(5) (Fraud and Related Activity in Connection with 
Access Devices )(FRACAD); Title 18, United States Code, Section 1201 (Kidnapping); and 
Title 18, United States Code, Section 1202(b) (Ransom Money). 

50. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. 18 U.S.C. §§ 2703(a), (b)(1)(A) & 
(c)(1)(A). Specifically, the Court is "a district court of the United States .., that - has 
jurisdiction over the offense being investigated.” 18 U.S.C. § 2711(3)(A)(I). 
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51. The investigation of this case is ongoing and disclosure of the issuance of the 
search warrant could result in destruction of evidence and could also impact officer, witness and 
victim safety. Accordingly, pursuant to the case law outlined in the government’s motion to 
seal, I respectfully request that the search warrant, search warrant affidavit, attachments, and 
returns be sealed. 


Further vour Affiant snv^th naught. 
^ Isl Signature Redacted 
Special Agent Jolene Goeden 
Federal Bureau of Investigation 





SUBSCRIBED and SWORN to before me 
' < 

;^isS^,4awo£iVl^;X . 2012. 

/s/John D. Roberts, USMJ _ 

= Signature Redacted -- 

• Tlortoraoie J.oim u: KOUeftSv, 

’.'United Stahssjviagistrate Judge 



IN THE MATTER OF THE SEARCH OF SILVER SONY CYBERSHOT CAMERA, 

MODEL #DSC-S700, S/N 0522961, CURRENTLY LOCATED AT FBI ANCHORAGE NON¬ 
DRUG EVIDENCE LOCKER 26 




KAREN L. LOEFFLER 
United States Attorney 

CRAIG M. WARNER 

Assistant U.S. Attorney 

Federal Building & U.S. Courthouse 

222 West Seventh Avenue, #9, Room 253 

Anchorage, Alaska 99513-7567 

Phone: (907) 271-5071 

Fax: (907)271-1500 

E-mail: craig.wamer@usdoj.gov 


IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF ALASKA 


) Case No.3:12-MJ-00140-JDR 

) 

) MOTION TO SEAL SEARCH 
) WARRANT, APPLICATION, 

) AFFIDAVIT FOR SEARCH 
) WARRANT, ATTACHMENTS, 

) AND RETURN 

) 

) FILED UNDER SEAL 

COMES NOW the United States of America, by and through undersigned 
counsel and hereby moves for an order sealing the Search Warrant, Application 
and Affidavit, and Returns for the search warrant issued in the above-captioned 
matter until further order of this Court. 

The government makes this motion to protect the investigative integrity of 
the present case. The investigation of this case is ongoing and disclosure of the 


In the Matter of the Search of: 

BLACK SANDISK M250 MP3 
PLAYER, 2GB 










issuance of the search warrant could result in destruction of evidence and could 


also impact officer, witness and victim safety. 

Historically, courts have recognized a “general right to inspect and copy 
public records and documents, including judicial records and documents,” 
Kamakana v. City and Countv of Honolulu. 447 F.3d 1172, 1178 (9th Cir. 2006) 
citing Nixon v. Warner Communications. Inc.. 435 U.S. 589, 597 & n.7 (1978). 
Nonetheless, access to judicial records is not absolute. A narrow range of 
documents is not subject to the right of public access at all because the records 
have “traditionally been kept secret for important policy reasons.” Id citin g 
Times Mirror Co. V. United States. 873 F.2d 1210, 1219 (9th Cir. 1989). Ninth 
Circuit case law has identified two categories of documents that fall into this 
category: grand jury transcripts and warrant materials in the midst of a pre¬ 
indictment investigation. Id Parties seeking to seal a judicial record not 
traditionally kept secret must provide compelling reasons to the court for doing so. 
Id. In general, “compelling reasons” are those sufficient to outweigh the public’s 
interest in disclosure. Id. at 1179. 

Based on the foregoing, the government respectfully requests this Court 
enter the attached proposed Order sealing said search warrant, Application and 

IN THE MATTER OF THE SEARCH OF BLACK SANDISK M250 MP3 PLAYER, 2GB, 
CURRENTLY LOCATED AT FBI ANCHORAGE NON-DRUG EVIDENCE LOCKER 
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Affidavit for Search Warrant, the Returns and this Motion and Order until said 
time as the government has time to review the information contained therein and 
act upon. 

RESPECTFULLY SUBMITTED this 22th day of March, 2012, in 
Anchorage, Alaska. 


karei^loeffler 

Uni j 7 

. isl Signature Redacted / 


Uni 


s/ Craig/M. Warner _ 

Assistant U.S. Attorney 

Federal Building & U.S. Courthouse 

222 West Seventh Avenue, #9, Room 253 

Anchorage, Alaska 99513 

Phone: (907) 27L5071 

Fax:(907)271-1500 

E-mail: craig.wamer@usdoj.gov 
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IN THE UNITED STATES DISTRICT COURT 


FOR THE DISTRICT OF ALASKA 


In the Matter of the Search of: 

BLACK SANDISK M250 MP3 
PLAYER, 2GB 


) Case No.3:12-MJ-00140-JDR 

) 

) ORDER GRANTING MOTION 
) TO SEAL SEARCH WARRANT, 
) APPLICATION, AFFIDAVIT 
) FOR SEARCH WARRANT, 

) ATTACHMENTS AND 
) RETURN 
) 

) FILED UNDER SEAL 


The United States requests that the Search Warrant, Application, Affidavit, 
Attachments and the Return filed in the above-captioned case be sealed. 


This Court finds that the need for secrecy to protect the ongoing 
investigation and potential witnesses outweighs the public’s right to inspect and 


copy judicial records and documents. 

IT IS HEREBY ORDERED that: 

The Search Warrant, Application, Affidavit and Attachments filed in the 


above-captioned case, and the Return to be filed, be sealed until further order of 
this Court. 

Further, the United States Attorney’s Office is directed to notify the Court 







// 


5 soon as the need for secrecy passes by filing a motion to unseal records. 
DATED this 22nd day of March, 2012, at Anchara^^fesW:'^'- 1 - 

/s/John D. Roberts, USNIJ 

Signature Redacted -~ H 

xv. JXWOJGIfelk ^-V.vV ; v, 

United States Ma^i^htf^udge 

.., Vlp>f . 















AO 93 (Rev. 12/09) Search and Seizure Warrant 


United States District Court 

for the , 

District of Alaska 

In the Matter of the Search of 
(Briefly describe the property to be searched 
or identify the person by name and address) 

ISRAEL KEYES 


SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the _ District of _ Alaska 

(identify the person or describe the property to be searched and give its location): 

ISRAEL KEYES, at the Anchorage Correctional Center. 


) 

) 

) Case No. 3:12-mj-00153-JDR 
) 

) 

) 


The person or property to be searched, described above, is believed to conceal (identify the person or describe the 
property to be seized): 

See Attachment A, which is evidence of violations of 18 U.S.C, Sections 1201, 1202(b), 1029(a)(5), 2119. 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or 


YOU ARE COMMANDED to execute this warrant on or before I 8 ; rzhO ) ^ _ 

(not to exceed 14 days) 

□ in the daytime 6:00 a.m. to 10 p.m. □ at any time in the day or night as I find reasonable cause has been 
established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property 
taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the 
place where the property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an 
inventory as required bylaw and promptly return this warrant and inventory to United States Magistrate Judge 
JOHN D- ROBERTS_. 


□ I find that immediate notification may have an adverse result listed in 18 U.S.C. § 2705 (except for delay 
of trial), and authorize the officer executing this warrant to delay notice to the personughq^.oj 'whose property, will be 

searched or seized (check the appropriate box) Ofor _days (not to exceedfl6j ^)^.\{,.• _'i 

□until, the facts “ 

Date and time issued: if 1- _ 

City and state: t vj> 0 , __ 


• .^fi^K^s/Johii P* Roberts, USMJ 
, * S ignature Redacted ■' 


fviaqistrate Judge John D~ Roberts 





























UNITED STATES DISTRICT COURT 
THE DISTRICT OF ALASKA 


) 

IN THE MATTER OF THE SEARCH OF ) Case No. 3:12-MJ-00153-JDR 

THE PERSON OF ISRAEL KEYES FOR ) 

BUCCAL SWABS ) Filed under seal 

) 

_ ) 

AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 

I, Joiene Goeden, being first duly sworn, hereby depose and state as follows: 

INTRODUCTION AND AGENT BACKGROUND 

1. I am a Special Agent of the Federal Bureau of Investigation (FBI). I have been a 
Special Agent of the FBI since April 2004. I am charged with the duty of investigating violations 
of the laws of the United States, collecting evidence in cases in which the United States is or may 
be a party in interest, and performing other duties imposed by law. I have been assigned to 
investigate most criminal matters within the jurisdiction of the FBI, including kidnaping matters, 
fraud matters and other white collar crime. 

2. I make this affidavit in support of an application under Rule 41 of the Federal 
Rules of Criminal Procedure for a warrant to seize DNA buccal swabs from Israel KEYES. The 
items to be seized are described in Attachment A. 

3. I believe that there is probable cause that evidence of the following federal crimes 
will result from the seizure and search of these items: Title 18, United States Code (USC), 
Section 1029(a)(5) (Fraud and Related Activity in Connection with Access Devices )(FRACAD); 
Title 18, United States Code, Section 1201 (Kidnapping); Title 18 , United States Code, Section 
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2119 (Carjacking); and Title 18, United States Code, Section 1202(b) (Ransom Money). The 
evidence to be collected from these seizures are described in Attachment B. 

RELEVANT STATUTES 

4. There is probable cause to believe that the hair and buccal swabs contain evidence 

of and is an instrumentality used for violations of Title 18, USC, Section 1029(a)(5), Fraud and 

Related Activity in Connection with Access Devices, which provides that: 

Whoever, knowingly and with intent to defraud effects transactions with 1 or more access 
devices issued to another person or persons, to receive payment or any other things of 
value during any 1-year period that aggregate value of which is equal to or greater than 
$ 1 , 000 ; 


and Title 18, United States Code, Section 1201 (Kidnaping), which provides that: 

Whoever unlawfully seizes, confines, inveigles, decoys, kidnaps, abducts, or carries away 
and holds for ransom or reward or otherwise any person, except in the case of a minor by the 
parent thereof, when the person is willfully transported in interstate or foreign commerce, 
regardless of whether the person was alive when transported in interstate or foreign commerce or 
uses the mail or any means, facility, or instrumentality of interstate or foreign commerce in 
committing or in furtherance of the commission of the offense; 


and Title 18, United States Code, Section 1202(b) (Ransom Money), which provides that:. 

Whoever receives, possesses, or disposes of any money or other property, or any portion 
thereof, which has at any time been delivered as ransom or reward in connection with a violation 
of section 1201 of this title, knowing the same to be money or property which has been at any 
time delivered as such ransom or reward; 

and Title 18, United States Code, Section 2119 (Carjacking), which provides that: 

Whoever, with the intent to cause death or serious bodily harm takes a motor vehicle that 
has been transported, shipped or received in interstate or foreign commerce from the presence of 
the person or presence of another by force and violence or by intimidation, or attempts to do so. 


IDENTIFICATION OF THE ITEMS SEIZED 


5. The property to be seized is identified in Attachment A. Agents would go to the 







Anchorage Correctional Complex where KEYES is currently housed to collect the samples. 
Agents would collect two buccal swabs from KEYES. Buccal swabs are seized by the gentle 
rubbing of the buccal cavity (which is the oral cavity formed by the teeth and gums and the 
interior of the cheeks and lips) with two dry, sterile cotton-tipped swabs. Consecutive swabs are 
used, one after the other to obtain an adequate sample for testing. 

6. The applied for warrant would authorize the extraction of DNA evidence that may 
be used to possibly link ISRAEL KEYES to the crimes set forth above. 

PROBABLE CAUSE 

7. The information contained below is from my personal knowledge and experience, 
information provided to me by other law enforcement personnel, or from those specific sources 
as set forth. Since this affidavit is being submitted for the limited purpose of seeking 

DNA samples, I have not included each and every fact known to me regarding this investigation. 

I have set forth only the facts that I believe are necessary to establish a foundation to support the 
aforementioned request for a search warrant. 

Abduction of Samantha Koenig 

8. On 2-2-12 at about 12:39 Alaska Standard Time (AST), Duncan, the owner of 
the Common Ground Coffee stand at 630 E. Tudor, Anchorage, Alaska, contacted APD 
dispatch. Duncan was calling from Oregon, where he was vacationing. He reported that while 
viewing his internet-based security system he saw one of his employees, 18-year-old S.K., 
appear to be abducted. Duncan said he was contacted by S.K.’s father (J.K.) and boyfriend 
(D.T.), who had been unable to locate her. This contact prompted Duncan to review his security 
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video which showed an unknown man climb through the window of the coffee stand at about 
20:00 AST on 2-1-12 while S.K. was working, The video appears to show S.K. retreating a short 
distance and raising her hands in an apparent sign of submission to the man who subsequently 
climbed into the coffee stand, robbed S.K, and escorted her away from the scene. The abductor 
climbed through the window into the coffee stand without any significant difficulty. He 
appeared to be significantly taller than S.K., who is 5'4" tall, but due to the limited lighting and 
quality of the video, a more accurate estimate of his height has not been made. The 
robber/abductor appeared to have a medium to large build and athletic movements. 

9. At the time of her abduction, S.K. was wearing a dark-colored jacket, a green 
shirt with light-colored stripes on the sleeves, a thin dark-colored bracelet, dark-colored pants, 
and dark-colored shoes. At the time of her abduction, S.K. was also believed to be in possession 
of a carabineer with three keys and possibly a white lanyard, a medium-to-large size leopard 
print purse, and a black cellular telephone with sliding keyboard. S.K. is a white female adult, 
approximately 5'4" tall, 150 pounds, 18 years old, with shoulder-length brown hair and brown 
eyes. 

10. Video surveillance appeared to show S.K.'s robber/abductor wearing a dark- 
colored, possibly hooded, jacket, dark-colored glasses, a dark-colored face mask, dark-colored 
gloves, dark-colored pants; and dark-colored shoes. He appeared to be carrying a white coffee 
cup and a dark-colored bag. Although to date no weapon has been conclusively identified in the 
surveillance videos that captured this robbery/abduction, the scene was generally poorly lit and 
the robber/abductor was not always fully visible, Furthermore, S.K.'s reaction appeared to be 
consistent with someone who was confronted or threatened with a weapon. In addition, during 
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separate subsequent interviews, both SX.’s father and boyfriend adamantly indicated that S.K. 
was veiy strong-willed and would not have complied with a robber or abductor’s demands, 
unless she had been threatened with a weapon. 

11. Surveillance video from a nearby Home Depot at approximately 19:54 AST on 2- 
1-12 showed a white Chevrolet extended cab truck roll through the Home Depot parking lot and 
park just east of an International House of Pancakes. From a distance, the surveillance showed 
-an individual with a black garment and hat get out of the truck and walk westbound through the 
parking lot towards Denali St., cross it, get on the sidewalk, walk southbound on Denali St. to 
Tudor Rd., cross Tudor Rd. at the intersection, and, finally, exit the frame. The individual’s 
travel was in the direction of the Common Ground Coffee stand, from which S.K. was abducted. 
One minute later, the video surveillance footage from Common Ground Coffee stand showed the 
individual who abducted S.K. approach from the direction of the man in the Home Depot video. 
Approximately two minutes after S.K. and her abductor exited the frame of the Common 
Ground Coffee stand video footage, two persons appearing to match S.K. and her abductor again 
entered the frame of the Home Depot video footage, this time walking back towards the location 
where the white Chevrolet track was originally parked. The Home Depot video then showed the 
two people.approach the passenger side door of the Chevrolet truck. It then showed the person 
who appeared to be S.K. enter the passenger side of truck. The other individual then walked 
around truck, entered the driver’s side, and drove out of the surveillance video’s frame. As 
described below, police have now identified KEYES’ residence and located a white Chevrolet 
truck registered to him at that residence. This white Chevrolet truck belonging to KEYES 
appears to match the vehicle in the Home Depot surveillance footage, although KEYES’ truck 
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has several toolboxes and a ladder rack fastened with removable bolts to the truck bed, and these 
items do not appear on the truck in the Home Depot video. 

12. During an interview on 02-02-2012, D.T. (SX’s boyfriend) said he went to the 
coffee stand on 2-1-12 at about 20:33 AST to give her a ride home but the stand appeared to be 
closed and she was not there. D.T. further reported to law enforcement that on 02/02/2012, at 
approximately 03:00 AST, he observed an unknown male adult wearing a ski mask and dark 
clothing going through the vehicle he shared with S.K. D.T. did not alert authorities to the 
burglary of the vehicle at that time. 

13. When D.T. was asked where his ATM debit card was by APD Detectives several 
days after the abduction, he indicated he had left it in the vehicle he shared with S.K. This 
vehicle had been seized by APD on 02-02-2012 and searched pursuant to a State of Alaska 
search warrant. The debit card referenced above was not located during the search; however law 
enforcement did not notify D.T. of this fact. D.T. indicated that his debit card was a Credit 
Union 1 VISA debit card (VISA debit card) bearing XXXXXXXXXXXX2851, expiration 
01/15, and that he did not give his VISA debit card to anyone else or give anyone permission to 
use it. The card is thus believed to have been stolen from D.T.'s vehicle at the time D.T. 
observed the vehicle break-in. D.T. further related that S.K.’s driver’s license had also been in 
his vehicle. That driver’s license was missing when searched for on 02-02-2012, indicating that 
it also was stolen at that time. I know that a driver’s license is generally necessary to leave the 
State of Alaska by airplane, road or ferry, due to established interstate (or international in the 
case of travel to/from Alaska via the Alaska-Canada Highway) travel requirements. 

Furthermore, due to Alaska’s unique geographic location, the difficulty of traveling by road 
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through northern Canada in winter, and the lengthy periods generally associated with traveling 
to/from Alaska by ferry, commercial airlines are the most common and popular mode of 
interstate travel to/from Alaska, especially during the winter. 

Ransom Note and Transfer of Funds to “Ransom Account” 

14. On 02-24-2012, at 19:56 AST, D.T. received the following text on his cell phone 
907-231-9835 from S.K.’s cell phone 907-884-8370 - “Conner park sign under pic of albert aint 
shepurty”. J.K. (S.K.’s father) contacted law enforcement officers and relayed the information. 
At the request of APD Detectives, at approximately 20:18 AST, APD Patrol Officers arrived at 
Conner Park located on the southeast comer of Jewel Lake Road and International Airport Road 
in Anchorage, Alaska. J.K.and D.T. were already present. Attached to the park sign, below a 
flyer for .a lost dog named “Albert,” was a ziploc bag which contained a folded piece of paper. 

15. On one side of the piece of paper, there was a photograph of S.K. with silver duct 
tape around her mouth and chin. She appeared to be wearing eye liner, and a light-colored, 
latex-gloved hand and lightly complected, muscular arm was holding S.K.'s hair. In the upper 
part of the photo was an Anchorage Daily Newspaper determined to be the issue released on 
Monday, February 13,2012. 

16. On the reverse side of the piece of paper was a ransom note which demanded 
$30,000. The note included the .16-digit card number of the debit card belonging to D.T., which 
he had reported stolen on the night of the kidnaping, as summarized above. This debit card 
number is correlated to a bank account number held by D.T. and S.K. The note demanded that 
$30,000.00 be deposited into that account and indicated that the writer of the note intended to 
withdraw money at regular intervals over the coming days, and in locations other than Alaska. 
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Specifically, it said, “I may not use the card much-id: ak'thie ta small pop but as I will be leaving 
soon I will be using it all over.” The note further gavfe:an-5f}it|jication that S.K. had been moved 
from Alaska, stating that “she did almost get away twice, once on tudor and once in the desert, 
must be losing my touch.” I know from research, training, and experience, and discussions with 
law enforcement officers familiar with Alaska that there are no areas in Alaska commonly 
referred to and known to be “deserts.” Many such areas do exist in Arizona, New Mexico and 
Texas. Subsequent analysis of the demand note by the FBI Laboratory revealed that it was typed 
with a typewriter that used a carbon ribbon, and that the aforementioned picture on the back of 
the demand note was printed with an inkjet printer. 

17. On 02-29-2012, at approximately 16:55 AST, J.K. contacted APD Detectives and 
told them he was withdrawing $5,000.00 from the reward account set up for S.K. at Denali 
Alaskan Federal Credit Union, and he intended to deposit it in the ransom fund, which was an 
account held by Credit Union 1. Pursuant to a State search warrant obtained by APD Detective 
Joseph Barth on 02-25-2012, investigators were informed that $5,000.00 was deposited in the 
Credit Union 1 account indicated on the ransom note, (the account attached to the Credit Union 

1 VISA debit card [VISA debit card] bearing XXXXXXXXXXXX2851, expiration 01/15 issued 
to D.T).at 17:45 AST on 02-29-2012). 

Unauthorized use of Credit Union 1 VISA debit card 

18. On 02-29-2012 at 22:13 AST, an unknown person utilizing D.T.’s Credit Union 1 
debit card attempted to withdraw $600.00 in US Currency from the account indicated on the 
ransom note. The attempted withdrawal took place at the Automatic Teller Machine (ATM) 
located at the Alaska USA bank at 4000 Credit Union Drive in Anchorage, Alaska. Because the 
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attempted amount was over the $500.00 daily limit, the withdrawal was declined. Surveillance 
video in the area of the ATM revealed a male dressed in a black hooded sweatshirt and black 
pants, operating a light-colored SUV, arrived in the parking lot of the Sea Galley restaurant 
across the street. After parking the SUV, the male exited and quickly walked across, the street to 
the area of the Alaska USA ATM. The SUV was later determined by the FBI to be a silver 
Nissan Xterra of a model between the years 2005 and 2012. As noted below, police have now 
determined that KEYES' girlfriend owns a silver 2007 Nissan Xterra. 

19. On 02-29-2012 at 23:56 AST, $500.00 in US Currency was withdrawn from the 
ATM at the Denali Alaskan Federal Credit Union located at 3020 Minnesota Drive in 
Anchorage, Alaska. The debit card utilized to withdraw the money was the same Credit Union 1 
debit card issued to D.T. Surveillance video obtained of the area revealed this withdrawal was 
conducted by an unknown male with a muscular appearance wearing a dark-colored, possibly 
hooded, jacket with a light-colored design or paint spatter on the left chest and front, and light- 
colored lettering, including possibly "CORPS" across the back shoulders; clear or light-colored 
glasses; a gray face mask; gray gloves; dark-colored pants; and light-colored shoes. 

20. During the course of the investigation. Detective Blanton and Officer Pierce of 
APD obtained surveillance footage from businesses surrounding the Alaska USA, which is 
located on Credit Union Drive in Anchorage, Alaska. Immediately before the withdrawal, a 
hidden surveillance camera located at the Sea Galley at 4101 Credit Union Drive in Anchorage, 
Alaska captured a similarly dressed male park in the extreme southwest comer of the Sea Galley 
parking lot driving a silver Nissan Xterra. From the surveillance video, the male appeared to 
exit the vehicle and walk westbound across the street to the Alaska USA and return a short while 
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later. Both the male’s appearance and timing are commensurate with him being the person who 
attempted to withdraw the money. 

21. On 03-01-2012 at approximately 00:28 AST, $500.00 in US currency was 
withdrawn from the ATM at the Alaska USA located at 7701 Debarr Road in Anchorage, 

Alaska. As with the prior two transactions, the debit card utilized to withdraw the money was 
the Credit Union 1 debit card issued to D.T. 

22. On 03-07-2012 at approximately 21:57 AST, $400.00 in US currency was 
withdrawn from the ATM at the Western Bank located at 200 West Rex Allen Road in Willcox, 
Arizona. The debit card utilized to withdraw the money was the Credit Union 1 debit card 
issued to D.T. Surveillance video on the ATM showed the individual using the debit card for 
■the withdrawal was a white male dressed in a gray hooded jacket or sweatshirt, glasses, a gray 
face mask, gray gloves, dark-colored pants, and light-colored shoes, and appeared to be driving a 
late model white Ford Focus sedan. 

23. On 03-07-2012 at approximately 23:24 AST, there was an attempted $400.00 
withdrawal at the Western Bank located at 711 Main Street in Lordsburg, New Mexico, using 
D.T.’s Credit Union 1 debit card (the same card referenced in prior paragraphs.) The withdrawal 
was declined by the ATM as it would have put the debit card over the daily withdrawal limit. 

At 23:25 AST, at the same ATM, a balance inquiry was conducted on the account utilizing the 
debit card. The balance shown was $3,598.91. At 23:26 AST, $80.00 was withdrawn from the 
account utilizing the debit card. Surveillance video on the ATM showed the individual using the 
debit card wore similar clothing to the first ATM withdrawal in Arizona. 

24. On 3-9-2012 at approximately 23:23 AST, there was a $483.00 withdrawal made 







at an ATM at Houston Community'Bank, 1515 FM 1960 Bypass East, Humble City, Texas. 
Initial review of the surveillance video from the ATM appeared to show that the individual using 
the debit card wore similar clothing to that worn during the two aforementioned ATM 
withdrawals in Arizona and New Mexico. 

25. On 03-11-2012 at approximately 23:47 AST, there was a. $480.00 withdrawal at 
the People's State Bank located at 5850 Hwy 59 South, Shepherd, Texas using D.T.’s Credit 
Union 1 debit card (the same card referenced in prior paragraphs.) Surveillance video on the 
ATM showed the individual using the debit card wore similar clothing to the first ATM 
withdrawal in Arizona, as well as the subsequent withdrawals in New Mexico and Texas. 

Stop of the White Ford Focus 

26. On 03/13/2012, at approximately 11:00 Central Time (CT), Texas Ranger Steven 
Rayburn, while in the company of FBI Agent Deborah Gannoway, was notified by Texas 
Department of Public Safety (DPS) Highway Patrol Corporal Bryan Henry (Corporal Henry) that 
a white Ford Focus sedan bearing Texas license plate DH4N930 was observed parked at the 
Quality Inn & Suites (QIS), 4306 South First Street, Lufkin, Texas, which is a short drive from 
Shepherd, Texas. 

27. On 03/13/2012, at approximately 11:15 CT, Ranger Rayburn and FBI Agent 
Deborah Gannoway responded to the QIS, at which time Agent Gannoway conducted a walk-by 
and visual inspection of the white Ford Focus. Agent Gannoway noted a bar-code sticker on. the 
driver's side back passenger window consistent with stickers applied to rental vehicles. Agent 
Gannoway also noted numerous items of clothing, trash and other debris in plain sight within the 
vehicle, including what appeared to be a girl's or woman's pink item of clothing. Ranger 




Rayburn caused a Texas license plate database search to be conducted which revealed the white 
2012 Ford Focus was registered to PV Holding Corporation, 9603 John Saunders Road, San 
Antonio, Texas. DPS Criminal Investigative Division (CID) Lieutenant Mickey Hadnot 
(Lieutenant Hadnot) maintained surveillance on the Ford Focus. 

28, On 03/13/2012, at approximately 11:30 CT, Lieutenant Hadnot reported to 
Ranger Rayburn, who was in the company of FBI Agent Deborah Gannoway, that a white male 
adult exited room 215 of the QIS, placed some items into the trunk of the aforementioned white 
Ford Focus, and departed the scene alone, driving the white Ford Focus. FBI Agent Gannoway 
had previously obtained from the QIS front desk manager an "in house list" of all occupants of 
the QIS on the night of 03/12/2012, which reflected room 215 was rented by ELIJAH KEYES 
for the time period 03/09/2012 through 03/13/2012. 

29. On 03/13/2012, at approximately 11:45 CT, Coiporal Henry conducted a traffic 
stop on the white Ford Focus sedan based in part on FBI Agent Gannoway’s suspicion that the 
vehicle was the same vehicle used in the Arizona, New Mexico, and Texas ATM withdrawals, 
as well as Corporal Henry's assessment that the driver of the vehicle was traveling in excess of 
the posted speed limit. Upon FBI Agent Gannoway’s arrival at the car stop location, Corporal 
Henry provided to FBI Agent Gannoway Alaska Driver's License number 7268639, in the name 
of ISRAEL KEYES, which KEYES had provided to Corporal Henry prior to Agent Gannoway’s 
arrival at the scene. Corporal Henry told Agent Gannoway that KEYES informed him he flew 
from Anchorage, Alaska, to Las Vegas, Nevada, on 03/07/2012, and that he rented the white 
Ford Focus at the Las Vegas airport, driving to his present location over the course of the 
ensuing week. KEYES provided to Agent Gannoway a copy of his car rental agreement, which 




corroborated his statement that he had rented the car at the Las Vegas, Nevada, airport on 
03/07/2012. KEYES was unable to describe to Agent Gannoway the route he drove from 
Nevada to Texas, but stated he was in Lufkin, Texas, to attend his sister's wedding in Wells, . 
Texas. KEYES told Agent Gannoway he "probably” paid for fuel throughout his travels from 
Nevada to Texas with cash. Ranger Rayburn reported to Agent Gannoway that there was a pair 
of large white tennis shoes partially pushed under the driver's seat of the Ford Focus, which 
Ranger Rayburn could plainly see through the window. During questioning by Agent Gannoway 
and Ranger Rayburn, KEYES became increasingly agitated and uncooperative, and he refused to 
allow Agent Gannoway and/or Ranger Rayburn to inspect his wallet (which was in his pocket) ■ 
or his vehicle. KEYES became unusually nervous and began to sweat profusely, in spite of the 
slightly c&ol weather and the tank top which he was wearing at the time. KEYES expressed to 
Agent- Gannoway that if he was going to be kept in the area for a longer period of time, he 
desired to call his brother (who.has KEYES' daughter in a separate car) and notify him of same. 
Agent Gannoway suggested KEYES make that call. A short time later, the 2012 Ford Focus was 
transported to and secured at the Lufkin, Texas, Police Department. 

30. Based on the aforementioned observations, including the fact that the rented Ford 
Focus matched the description of the vehicle utilized in the ATM withdrawals in Arizona, New 
Mexico and Texas, KEYES' arrival in Las Vegas, Nevada, and his subsequent travel from 
Nevada to Texas, very likely resulting in KEYES traveling through Arizona on or about 
03/07/2012 (the date of a $400.00 ATM withdrawal in Arizona) and New Mexico on or about 
03/08/2012 (the date of an $80.00 ATM withdrawal in New Mexico), KEYES' appearance 
closely matching the description of the white male adult observed in videos of the above- 
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described ATM withdrawals, KEYES' own admission that he lived in the Anchorage, Alaska, 
area, KEYES’ Alaska driver's license reflecting an Anchorage, Alaska, address, the white tennis 
shoes under the driver’s seat matching the description of the shoes worn by the white male adult 
observed in the videos of the above-described ATM, as well as other observations. Agent 
Gannoway instructed Corporal Henry to place KEYES under arrest. Ranger Rayburn, in Agent 
Gannoway’s presence, searched KEYES’ wallet, revealing a VISA ATM/Debit card bearing 
account number XXXXXXXXXXXX2851, expiration date 01/15, in the name of D.T. This 
card is linked to the “ransom account” identified above, from which the withdrawals and 
attempted withdrawals summarized above were made. 

Discovery of KEYES’ White Chevrolet Truck 

31. APD Detectives discovered that ISRAEL KEYES listed a mailing address of 
3705 Arctic Blvd. #2891 in Anchorage, Alaska, on 07-18-2011, which is the Mail Cache. APD 
Detectives also discovered that KEYES listed a residential address of 2456 Spurr Lane in 
Anchorage, Alaska, as of 07-18-2011. 

32. On 03-13-2012 at approximately 10:30 AST, members of the APD Special 
Assignment Unit went to KEYES’ home address at 2456 Spurr Lane in Anchorage, Alaska. Ho 
one answered repeated knocks on the door. Per APD Sergeant Redick, there were fresh tire 
impressions in the snow in the driveway of the address that appeared as if a vehicle had been 
parked there as recently as the morning of 03-13-2012. 

33. There was also a white Chevrolet pickup truck parked in the driveway of the 
address. The truck had a large toolbox in the bed and a ladder rack on top, The bolts securing 
those items were removable and appeared to have been recently added. The license plate on the 
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truck was Alaska license plate FTC990, relating to a white 2004 Chevrolet Silverado, registered 
to ISRAEL KEYES at 2456 Spurr Lane in Anchorage, Alaska. The white Chevrolet truck 
appeared to match the vehicle appearing in the Home Depot surveillance video, as summarized 
above. Further, Detectives eventually contacted KEYES’ girlfriend and discovered that she 
drives a 2007 Nissan Xterra, which matched the general description of the vehicle used by an 
individual who appeared to attempt to use the stolen debit card on 2-29-12, as summarized 
above. 

Execution of Search Warrant on Ford Focus 

34. On March 16, 2012, law enforcement agents in Beaumont, Texas obtained a 
search warrant, which authorized the search of the white Ford Focus driven by KEYES. 
Execution of that search warrant on March 17, 2012 revealed numerous items, including a 
cellular phone believed to belong to S.K. 

Initial Interviews with Israel Keyes 

35. KEYES was transported to Anchorage, Alaska and arraigned on March 27,2012 on 
one count of Access Device Fraud. He was provided defense counsel at government expense. 
Subsequently, KEYES agreed through counsel to be interviewed by law enforcement. On March 
30,2012, two interviews with KEYES took place. In the first interview, investigators presented 
KEYES with a selection of the evidence and investigative actions summarized above. KEYES 
then requested some time to speak alone with his attorney. Several hours later, KEYES agreed 
through counsel to be interviewed by law enforcement. In this second interview, KEYES stated 
that he had abducted S.K. on 2-1-12, and that she had been dead before he left for a vacation 
approximately ten hours after the abduction. KEYES indicated that S.K.’s body could be found 





in Matanuska Lake in Alaska, and identified the precise location at which he had dropped her 
remains through the ice. KEYES indicated that he raped S.K. before and after murdering her, 
and that he believed that law enforcement would find his DNA when they found her body. 
KEYES indicated that he had “lots more stories to tell,” and stated that his ex-girlfriend knew 
nothing of his criminal activities, as he was “two different people.” When asked how long he 
had been “two different people,” KEYES immediately and specifically responded, “fourteen 
years.” 

36. On April 1,2012, KEYES agreed through counsel to a third interview with law 
enforcement. In this third interview, KEYES explicitly stated that he murdered S.K., and gave 
substantial details about the murder. He further explained how he posed S.K.’s body to appear 
alive in order to take the ransom photograph noted above, and gave details about the location 
and manner of his disposal of S.K.’s body. 

Discovery of S.K. ? s Body 

37. On April 2,2012, investigators discovered S.K.’s remains in Lake Matanuska, at 
the precise location identified by KEYES. SK’s remains were transported to the State of Alaska 
Medical Examiner’s office for a forensic exam and autopsy. During the course of this exam, 
trace evidence including hairs were removed from S.K.’s. Body. 

Fourth interview with KEYES 

38. On April 6, 2012, KEYES agreed to a fourth interview, on the explicit terms that 
the S.K. case would not be discussed. KEYES indicated his willingness to share “other stories” 
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with investigators. In this interview, KEYES implied that he had murdered many persons over 
the past fourteen years, in many different locations. KEYES stated that he had many “cards to 
play,” and didn’t want to give them all away at once. He was asked to give the identity and 
location of just one body. After thinking silently for about twenty seconds, KEYES stated, “I’ll 
give you two.” He then confessed to the kidnapping, carjacking and murder of B.C. and L.C. 
near Burlington, Vermont in June 2011. After working with an electronic map for 
approximately thirty minutes, KEYES located the abandoned farmhouse in which he believed he 
had disposed of their remains. KEYES also indicated that he thought that his DNA might be 
recovered when they recovered the bodies. 

39. A quick records check verified that, indeed. Bill and Lorraine Currier, ages 49 
and 55, had inexplicably gone missing on June 8, 2011. KEYES stated that, when he killed the 
Curriers, he was in Vermont en route to a vacation in Maine, technically visiting family. 

KEYES identified one hotel at which he stayed, and indicated that Bill and Lorraine Currier had 
lived in a house several blocks from this hotel; KEYES indicated he had chosen the Curriers 
randomly. 

40. Vermont investigators have been contacted and are working on attempting to 
corroborate KEYES’ confession. Investigators contacted the hotel identified by KEYES and 
verified that he had indeed been a guest there during the relevant time period. However, the 
farmhouse where KEYES stated that he disposed of the bodies has been demolished. 
Investigators plan on excavating the area where the farmhouse stood this week. 


41.. During their investigation, which involved the forensic processing of the Curriers' 





vehicle that had been taken, investigators collected hairs and DNA. Accordingly, comparison 
of KEYES' DNA to that which has been recovered (as well as DNA that might be recovered 
should the Curriers' bodies be found), might result in confirming KEYES' confession. 

42. On the basis of these facts and my training and experience, I believe that there is 
probable cause to believe that DNA samples from KEYES will provide evidence to link him to 
the abductions and murders of S.K., and Bill and Lorraine Currier. I consulted with AUSA 
Frank Russo about the proper vehicle in which to bring this request to the court. AUSA Russo 
advised me to apply for a search warrant as the giving of a DNA sample does not constitute a 
testimonial communication, and therefore does not violate Vongthongdy's Fifth and Sixth 
Amendment rights. United States v. Lewis. 483 F.3d 871, 873-874 (8th Cir. 2007) (collection of 
buccal swabs was not a critical stage of the proceeding and did not violate the defendant's Sixth 
Amendment right to counsel); see also, United States v. Wade . 388 U.S. 218, 227 (1967) 
(preparatory steps in the gathering of the Government's evidence "such as systematized or 
scientific analyzing of the accused's fingerprints, blood sample, clothing, hair and the like" do 
not violate the defendant's Sixth Amendment right to counsel). 


// 


// 
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Details: Albany Division requests the Evidence Response Team 

Unit (ERTU) provide assistance to Albany Division in coordinating 
resources from Hazardous Material Operations Unit (HMOU) and 
additional Evidence Response Team (ERT) personnel in support of 
the search for human remains at a landfill in Coventry, Vermont. 

Background of the Investigation and Intelligence that has led the 
FBI to the Landfill 
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to report that the subject, of ■captioned matter, Israel Keyes, 
confessed to killing Billt .an'dVAorraine Currier, of Essex, 

Vermont, in June, 2011. j'Tbe Curriers have in fact been missing 
since June, 2011. Anchor a ** /.vision reported that Keyes left 

the Curriers' bodies ! __|in 
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authorities determined that the farmhouse was located at 32 
Upper Main Street, Essex, Vermont. Further investigation 
revealed that this abandoned farm house was demolished in 
October, 2011. While conducting the demolition and excavation, the 
machinery operator noticed a plastic bag, and smelled a strong odor 
coming from the house. The smell was similar to the smell of a dead 
animal. When the basement was cleared of debris the strong smell 
was gone, and the basement was filled in with the stone walls that 
were once the first floor walls of the farmhouse. The area was then 
covered over with dirt. 

Anchorage Division reported that Keyes stayed at a motel in 
Vermont around the time the Curriers went missing. Investigators 
identified this motel and located Keyes name in the motel guest 
register where he checked in as a guest around the time the 
Curriers went missing. 

On April 12 and 13, 2012, the basement of the abandoned farmhouse 
was searched by investigators with the FBI, the Vermont State 
Police and the Essex Police Department, however, no human remains 
were recovered. It is presumed that the remains were among the 
debris carted away from the demolished farmhouse in October, 

2011. The debris from the farmhouse was first taken to the All 
Cycle Transfer Station in Williston, Vermont where it was then 
reloaded onto trucks and transported to a landfill in Coventry, 
Vermont - 

While the search of the old farmhouse did not yield any human 
remains, Anchorage Division also provided Albany Division with 
information as to the location of weapons hidden/disposed of by 
Keyes in the Adirondack Mountains of New York, specifically in 
the area of a boat launch at the Blake Falls Reservoir, 
Parishville, New York. Anchorage Division reported that Keyes 
hid a Home Depot bucket under a 4' x 6' rock, and that Keyes 
threw a barrel and bolt from a Ruger 10/22 into the Blake Falls 
Reservoir. The Home Depot bucket was recovered by Albany ERT on 
April 18, 2012, and the bolt and barrel were recovered by the 
USERT on April 24, 2012. 

What is the rush to search the landfill? 


The Curriers have been missing since June, 2011. The information 
received from Anchorage Division is one of the first solid leads 
received concerning the Curriers disappearance. The US 
Attorney’s office in Anchorage intends on charging Keyes with 
kidnaping of the couriers. Additionally, the FBI and the Essex 
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Police Department would suffer negative press and community 
relations should an attempt to recover the Currier's bodies at 
the landfill be declined. 


How and when were the bodies transported to the Landfill ? 

Investigation has determined that the debris from the basement of 
the abandoned farmhouse most likely arrived at the Coventry, 
Vermont landfill from All Cycle Transfer Station late in the day 
on October 26, 2011, or on October 27, 2011. Landfill operators 
have identified the approximate waste placement area of trash on 
the day of October 26, 2011, and on the day of October 27, 2011, 
to encompass an area of approximately 100 feet X 140 feet and 
approximately 12 feet deep. 

Shortly after the trash was deposited at the Coventry Landfill on 
October, 26, 2011, and October, 27, 2011, this area of the 
landfill was closed and no further trash was dumped in this area. 
As a result, the trash to be searched is at or near the top of 
the landfill. In preparation for the closure of this area of the 
landfill, Casella Waste Systems took aerial photographs of the 
landfill on October 28, 2011. The landfill management has 
provided the FBI with an aerial photograph dated October 28, 

2012, along with topographical maps that depict approximate waste 
placement on the days in 2011 of October 24, 25, 26, 27 and 28. 

Where were the bodies placed that resulted in the bodies being 
placed in the trash? 

See above. 

What dav were the bodies taken to the transfer station and then 
to the landfill? 


The demolition of the old farmhouse occurred between October 25, 
2011 and October 27, 2011. Debris was hauled from the site of 
the old farmhouse to the All Cycle Transfer Station in Williston 
as follows: 

October 25, 2011 — 10 trips/loads 
October 26, 2011 — 8 trips/loads 
October 27, 2011 — 2 trips/loads 

Trash was hauled from the All Cycle Transfer Station to the 
Coventry Landfill as follows: 
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October 25, 2011 — 13 tractor trailer loads 

October 26, 2011 — 13 tractor trailer loads 

October 27, 2011 — 12 tractor trailer loads 

Based on interviews of the crew that demolished the old 

farmhouse, it is believed that the debris from the basement was 
cleared from the area of the old farmhouse in the afternoon of 
October 26, 2011, and dumped the next day at the Coventry 
Landfill. It is unlikely that debris cleared on October 25, 
2011, included material from the basement inasmuch as the 
demolition crew demolished the house starting with the second 
floor of the structure working their way down to the basement. 

What carting company hauled the debris from the Old Farmhouse to 
the All Cycle Transfer Station and from the All Cycle Transfer 
Station to the Coventry Landfill? 

Farmhouse to All Cycle Transfer Station: | | 

(independent hauler) 

All Cycle Transfer Station to Coventry Landfill: MBI Trucking 


Is there a transfer station between the Old Farmhouse and the 
Coventry Landfill? 

Yes, All Cycle Transfer Station. See above. 

How many tons of trash does the landfill received daily? 

Casella Waste Management personnel at the Coventry Landfill 
provided topographical maps, each of which identifies the 
approximate waste placement and the approximate cubic yards of 
waste placed as follows: 


Date 

10/24/2011 

10/25/2011 

10/26/2011 

10/27/2011 

10/28/2011 


Approximate 
Cubic Yards 
Placed 

2,220 

2,220 

1,900 

1,680 

1,720 


What exactly are vou looking for? 
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The bodies of Bill and Lorraine Currier. 

Do you have r >~rdhah>1 .e cause for a search warrant? 

The authority for the search will be via consent received from 
Casella Waste Systems Inc. The United States Attorney's office 
in Vermont is coordinating getting the necessary waivers frwi 
regulatory bodies in Vermont. ” :! J 

Where is the trash going to be spread for the search? 

The landfill will prepare with gravel a 100' x 200' staging area 
for trash to be searched by search personnel. The staging area 
is approximately 150 feet from the excavation site. Albany 
Evidence Response Team Senior Team Leader believes this area will 
be sufficient for one and possibly two sifting operations. After 
the waste has been sifted, a bulldozer will push the waste off to 
the side where it will be compacted by landfill personnel when 
appropriate. 

The landfill will also prepare with gravel walking areas and an 
area for a shelter/tents on top of the landfill for workers to 
take breaks while heavy equipment replaces the searched trash 
with un-searched trash. Additionally, off the pile, there is a 
turn around area on the access road on which rented construction 
trailers can be placed for searchers to have lunch. 

What heavy equipment is available to assist with the search? 

Casella Waste Systems is not able to provide its landfill 
equipment for the search and also maintain its normal operations 
at the landfill. Casella Waste Systems proposed the following 
equipment and is requesting quotes from Casella Construction: one 
excavator with grapple, one loader, one bulldozer, and one water 
truck. 

Do you have a realistic timeline? 

Based on the estimated, average figures provided by ERTU in their 
Landfill Search Considerations white paper, specifically that 
teams of 20 people could search 400 to 500 tons of garbage per 
day, and that an area 100 feet x 150 feet, by 10 feet deep 
contains approximately 4200 tons of garbage, Albany estimates its 
search area, which is similar in size to the area referenced in 
the white paper, taking between ten and fifteen days to search. 
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If nothing is found after ten days, Albany Division will reassess 
the search operation. 

Who is going to pay for the search? 

This is a lead on an Anchorage Division case being worked by 
Albany Division in Albany Division territory. CID has provided 
an enhancement to Albany Division's budget to begin covering the 
costs of the landfill search. 

Other information concerning the Coventry Landfill received from 
Casella Waste Management personnel 

The landfill receives medical waste, however, the last medical 
waste received in the area to be searched was on October 10, 

2011. The landfill mixes treated solid human waste with the 
trash it receives at the landfill. The trash to be searched 
which was dumped in October, 2011, was mixed with treated solid 
human waste. 

Landfill safety personnel recommend the following PPE: Safety 
boots, double gloves (nitrile gloves under good leather/canvas 
gloves), four gas meters for FBI safety personnel, half face 
respirators with P100 filters. Gases at the landfill include 
methane and hydrogen sulfide. The heat coming off the trash will 
be approximately 90 - 100 degrees Fahrenheit. 

Points of Contact at the Landfill (Casella Waste Systems Inc) 


Desk 

Cell 



b6 

b7C 
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Personnel Protective Equipment (PPE), other supplies, HMOU and 
Specialists needed 

Albany requests the following: 

1. Request ERTU coordinate approximately 15 field ERT 
personnel to assist with the landfill search. 

2. PPE for approximately 30 search personnel consisting 
mostly of FBI personnel and a small group of Vermont 
state and local law enforcement officers who will 
provide support for the landfill search. 

3. Digging, sifting and other tools necessary to 
appropriately conduct a landfill search. 

4. Forensic anthropologists for bone identification.' 

5. Request support from HMOU 

a. To set up an incident command structure, 

b. To provide a safety officer, 

c. To provide a paramedic, 

d. To provide shelter for lunch and breaks, 

e. To provide porta-johns, 

f. To provide decontamination areas, 

g. To provide command post vehicles that support 
connectivity—high side,. .IqV .side, SVTC, 

h. Other items deemed nedes Isary: •, t o support the 
safety of personnel at a landfill search. 

6. In preparation for the search, request that HMOU 
coordinate with 

a. Casella Waste Systems safety personnel 

b. Local EMS and local fire department 
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LEAD(s): 

Set Lead 1: (Action) 

LABORATORY 

AT QUANTICO, VA 

Albany Division requests the Operational Response 
Section Evidence Response Team Unit (ERTU) and Hazardous Material 
Operations Unit (HMOU) provide support and coordinate additional 
regional Evidence Response Team (ERT) personnel in support of the 
search for human remains at a landfill in Coventry, Vermont. 


♦♦ 
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Enclosure(s) : Email from SOS 
Attorneys Office 


] to the United States 


Details; On Ma rch 15, 2012, Staff Operations Specialist (SOS) 
I ~| sent an emai l to the United States Attorneys 

Office in Anchorage, Alaska | 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE 

To : Anchorage 


From: Anchorage 

Squad C-2 

Contact: [ 


Date: 04/16/2012 


Attn: SSi| 

SA 
SA 


Approved By: 


Drafted By: 


3DU- 

Case ID #: -3A-AN-15642 (Pending) 

Title: KEYES, ISRAEL 

KOENIG, SAMANTHA, TESSLA 


To report| 


X 


^ to the United States 


Enclosure(s) : Email from SOsQ 
Attorneys Office 

Details : On Ma rch 15, 2012, Staff Operations Specialist (SOS) 

| | sent an emai l to the United States Attorneys 
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FD-302 (Rev. 10-6-95) 


# • 


- 1 - 

FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 04 720 /2012 

On 04/12/2012, personnel from the Federal Bureau of 
Investigation (FBI) assisted the Vermont State Police with a 
consent search at 32 Upper Main Street, Essex, Vermont. The 
location consisted of a basement filled with demolition debris. 
The demolition debris came from the demolition of the house that 
was located at this address when it was demolished in the fall of 
2011. The following FBI personnel assisted with the search on 
04/12/2012: 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 04/20/2012 

On 04/13/2012,. personnel from the. Federal Bureau of 
Investigation (FBI) assisted the Vermont State Police with a 
consent search at 32 Upper Main Street, Essex, Vermont. The 
location consisted of a basement filled with demolition debris. 
The demolition debris came from the demolition of the house that 
was located at this address when it was demolished in the fall of 
2011. The following FBI personnel assisted with the search on 
04/13/2012: 




SA 

SA 

SA 

SA 

SA 

ITS 

SA 

SA 


b6 

b7C 


investigation on 04/13/2012 at Essex, Vermont 


File # Ntft-AN-15642 6 f 


SA I ~l _ 

This document contains neither recommendations nor conclusions of the FBI. 
it and its contents are not to be-distributed outside your agency. 


-&06-AM-I56.45-IU 

It is the property of the FBI and is loaned to ycfaf agency; 

lil| |o3-3o;J 






FD-302 (Rev. 10-6-95) 


FEDERAL BUREAU OF INVESTIGATION 


_On April 18, 2012, pursuant to consent received from 

| | Supervisor, Brookfield Renewable Energy Partners L.P., 

a search was conducted in the vicinity of the Blake Falls Reservoir 
boat launch located on Raguette River Road, Parishville, New York. 
The GPS coordinates for the boat launch are N 44 degrees 28.120’ W 
074 degrees 45.789’. The search began at approximately 8:10am and 
concluded at approximately 5:40pm. The search was conducted by the 
following Special Agents (SA) of the Federal Bureau of 
Investigation (FBI): 


Dig ital p hotographs were taken by SA [ . I SA 

| l and .SA I | completed a photo log to correspond with each 

photograph taken. The digital images captured were archived from 
the camera storage media to a DVD. The original DVD and a back-up 
of the original DVD were placed in 1A envelopes and are maintained 
with the case file. 


A sketch of the boat launch area was prepared by SA 
| | A sket ch of th e area where evidence was recovered was 

prepared by SA | | Both sketches depict the basic layout of 

the respective areas. These sketches were of approximate 
measurements and were not made to scale. The sketches are 
maintained in a 1A envelope with the case file. 

The following items of evidence were seized: 

1) Home Depot Bucket 

2) Black Dog Machine LLC AR15 .22 Conversion 50RD 

magazine 

3) Black plastic tube/silencer 

4) Ruger 22 Charger Serial Number 490-36145 Trigger 

Mechanism and TruGlo Scope attached and Gun Part with 

Spring 


Investigation 4/18/2012 at Parishville, New York 
File if \a-AN-15642 -}4-2^ _ Date di 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. I-. ^ 
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7A-AN-15642 


Continuation of FD-302 of 


Search at Blake Falls Reservoir 


,On 04/18/2012 ,Page 


5) Ruger Model 10/22 Carbine .22 L.R. Caliber Serial 
Number 111-23612 minus Stock also includes Simmons Scope 
attached. 

6) Plastic Stock with Sling 

7) Wood Stock with Sling 

8) Wire with Black Cloth 

9) Bipod 

10) Bag of Damprid 

11) 4 Empty magazines 

12) 3 Loaded .22 caliber magazines 

13) Box of Griprite fasteners, 2 1/2 inch screws 

14) 1 Box Remington SubSonic .22 Caliber Long Rifle 
Hollow Point Ammunition and 2 boxes Federal Champion .22 
Caliber Long Rifle Ammunition 

15) 19 rounds loose .22 caliber ammunition 

16) Black Handle with Metal Clip 

17) Black Flashlight Maglite 

In conclusion, the above items of evide nce were 
transported in the care and custody of Sa|| to the office 
space of the FBI, Albany, New York, where tney were inventoried and 
secured. 
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Precedence: ROUTINE Date: 04/26/2012 

To: Anchorage Attn: SA | [ Squad C-2 

From: Albany 

Burlington, Vermont RA_ 

Contact: |_| 


Approved By: 
Drafted By: 


Case ID #: ^A-AN-15642 (Pending) _ 

Title: ISRAEL KEYES 

SAMANTHA TESSLA KOENIG - VICTIM; 

KIDNAPPING/HOMICIDE 

Synopsis: Information regarding Albany Division searches 

Enclosure(s) : (2) FD-302s documenting Essex, VT search; FD-302 

documenting Blake Falls Reservoir land search; FD-340s containing 
Original DVD and a Back-up of the Original DVD of digital photos 
taken at Blake Falls Reservoir land search on 04/18/2012; Two 
working copies DVDs of digital photos taken at Blake Falls 
Reservoir land search on 04/18/2012; FD-340 containing ERT 
paperwork and notes; FD-340 containing emails leading up to Blake 
Falls Reservoir land search; CD containing electronic copy of ERT 
Casebook of Blake Falls Reservoir land search on 04/18/2012; 
Printed version of ERT casebook of Blake Falls Reservoir land 
search on 04/18/2012 

Details: On 04/12/2012 and 4/13/2012, personnel from Albany 
Division assisted with a consent search of 32 Upper Main Street, 
Essex, Vermont. On 4/18/2012, personnel from Albany Division 
participated in Blake Falls Reservoir land search. Documentation 
of each search is enclosed. 
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LEAD{s): 

Set Lead 1: (Info) 

ANCHORAGE 

AT ANCHORAGE, AL 
Read and clear. 
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ADMINISTRATIVE WORKSHEET 


General Information 


Location 

Blake Falls Reservoir - Parishville, New York 

Date/Time of Arrival 

Apr 18, 2012 08:10 AM 

Case ID 

7A-AN-15642 

Latitude & Longitude 

Lat. 44.46852800 Long. -74.77258300 

Condition of Scene on Arrival 

Unsecured reservoir and boat launch. 

Lighting 

Daylight 

Weather 

Clear 

General Description 

The area of the search is located on the west shore of the Blake Falls 
Reservoir to the south of a boat ramp, in the area of the boat ramp 
approximately 50 feet to the south of the boat ramp, a creek goes under 
Raquette River Road and empties into Blake Falls Reservoir. The GPS 
coordinates for the boat ramp at the no swimming sign are as follows: N 44 
degrees 28.120', W 074 degrees 45.789’. Evidence listed in the evidence log 
was located approximately 329 feet south of the boat ramp. 

Person in Charge on Arrival 


Control of Scene Obtained From 


Date/Time of Control Acquisition 

Apr 18, 2012 08:10 AM 


Persons On Scene 



Notes 


Preliminary Survey/Evidence 
Evaluation 

(Notes/Observations) 


Special Situations, Conditions, 
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ADMINISTRATIVE WORKSHEET 


and/or Specialists Used 

(Notes/Observations) 


Crime Scene Conference 

(Notes/Observations) 


Final Survey 

(Notes/Observations) 


Narrative 

(Notes/Observations) 

Received consent to search the premises surrounding the southern boat 
launch at the Blake Fails Reservoir from| (Supervisor, 

Brookfield Renewable Energy Partners L.P. 

USERT S/>| |vas present at the beginning of the search 

conducting a site survey for a future dive operation. 

SAs | [searched around large rocks between the boat 

launch driveway and the area of the creek. Also walked the woods on the 
south side of the creek approximately 75 yards to the south of the boat 
launch area driveway. 

The cleared area between the road and the tree line is covered with a thick 
growth of tall grass/sticker bushes. There are areas of steep drop offs 
between the road and the tree line, however, once in the tree line, the 
incline is not as steep. 

There is a large rock approximately $' high by 12' wide located immediately 
to the south side of the creek near the reservoir (see photos). 

At approximately 2:15pm, 5A| [located a large rock slab that was 

approximately 4' wide by 6' tall. The rock slab stood approximately 6’ tali, 
and it was leaning against a large boulder which was mostly in the ground, 
but was partially exposed on the downhill side. The rock slab was in an 
area of relatively steep terrain. The 4’ x 6' rock slab was standing on its 
end, and it was leaning against the large boulder at about a 70 degree 
angle, creating a sheltered area between the rock slab and the boulder. On 
the ground in the sheltered area was a pile of bowling ball sized rocks 
which were covered by a few broken branches. Among the bowling bail 
sized rocks were chunks of moss which appeared to have been placed on 
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ADMINISTRATIVE WORKSHEET 


the bowling ball sized rocks rather than growing there naturally. A Home 
Depot bucket with a lid was concealed beneath these bowling ball sized 
rocks. 

The location of the 4'x6' rock slab was approximately 329' south of the boat 
ramp driveway. A sketch was prepared for the area of the rock slab. In 
order to measure the rock slab into the sketch, measurements were taken 
from a power line pole to the south of the 4'x6' rock slab and from a tree on 
the Raquette River Road. The location of the tree on Racquette River Road 
was also approximately 329' from the boat ramp driveway. The tags on the 
power line pole were noted and photographed. The initials "TKT" were 
spray painted in red on the tree next to Raquette River Road. In addition, a 
red line was sprayed on Raquette River Road in the front of the tree with 
the "TKT" initials. "TKT" was also spray painted in red on the underside of 
the 4’x6' rock slab. The GPS coordinates of the location of the 4'x6' rock 
slab were as follows: N 44 degrees 28.067’, W 074 degrees'45.813’. 

The Home Depot Bucket was carried back to the area of the boat launch 
where the lid was opened and the contents of the bucket were inventoried, 
photographed, and packaged. 

The Home Depot Bucket and its contents were transported by SA | | and 

SA | [ to FBI Albany. The Home Depot Bucket and its contents were 
temporarily secured for the evening in the ERT room by engaging the 
combination lock to the ERT room. On 4/19/2012, the evidence was sealed 
by SA | j and SA | [ and turned over to evidence control. 


Search Completion 


Release of Scene Authorized By 



Release of Scene To 


Date/Time of Scene Release J Apr 18,2012 05:40 PM 
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EVIDENCE RECOVERY LOG 


Evidence Recovery Log 


Item # 

Description 

Recovered By 

Observed By 

Date Found 

1 

Home Depot Bucket 

1 

1_1 

4/18/2012 


Where Found 

Packaging/Marking 

Grid 

Room/Area 

Comments 

Blake Falls Reservoir, 

329'South of boat 

launch driveway 

Cardboard Box 

(Indirect) 



The bucket includes a 

lid that sealed the 

bucket when it was 

located. 



Item # 

Description 

Recovered By 

Observed By 

Date Found 

2 

Black Dog Machine LLC 

AR15 .22 Conversion 

50RD magazine 

1-1 

1 1 

4/18/2012 




Where Found 

Packaging/Marking 

Grid 

Room/Area 

Comments 

In evidence item #1 

Kpac (Indirect) 



Evidence repackaged to 
minimize movement of 

item. Original 
packaging sealed with 

item. 


Item # 

Description 

Recovered By 

Observed By 

Date Found 

3 

Black plastic 
tube/silencer 

1 

1 1 

4/18/2012 




Where Found 

Packaging/Marking 

Grid 

Room/Area 

Comments 

In evidence item #1 

Cardboard Box 

(Indirect) 





Item# 

Description 

Recovered By 

Observed By 

Date Found 

4 

Ruger 22 Charger Serial 

Number 490-36145 

Trigger Mechanism and 
TruGlo Scope attached 
and Gun Part with Spring 

1 1 

i r 

4/18/2012 




Where Found 

Packaging/Marking 

Grid 

Room/Area 

Comments 

In evidence item #1 

Cardboard Box 



Evidence repackaged to 
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(Indirect) 


minimize movement of 
item. Original 
packaging sealed with 
item. 


Item # 

Description 

Recovered By 

Observed By 

Date Found 

5 

Ruger Model 10/22 
Carbine .22 L.R. Caliber 

Serial Number 111- 

23612 minus Stock also 

includes Simmons Scope 

attached. 

1 - 1 

1 T 

4/18/2012 




Where Found 

Packaging/Marking 

Grid 

Room/Area 

Comments 

In evidence item #1 

Cardboard Box 

(Indirect) 



This weapon was 
cleared by SA| [ 

j |at the Reservoir 

and again on 4/19/2012 
byS^ ! 

who signed the FD- 
1004. This evidence 

item was repackaged to 

minimize movement of 

the item. Original 
packaging sealed with 
item. 


Item # 

Description 

Recovered By 

Observed By 

Date Found 

6 

Plastic Stock with Sling 

1 

.r 

4/18/2012 


Where Found 

Packaging/Marking 

Grid 

Room/Area 

Comments 

In evidence item #1 

Cardboard Box 

(Indirect) 



Evidence repackaged to 

minimize movement of 
item. Original 
packaging sealed with 
item. 
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item# 

Description 

Recovered By 

Observed By 

Date Found 

7 

Wood Stock with Sling 

1-i 

_l 

4/18/2012 


Where Found 

Packaging/Marking 

Grid 

Room/Area 

Comments 

In evidence item 81 

Cardboard Box 
(Indirect) 



Electrical tape wrapped 
around stock near top 
of handle. Evidence 
repackaged to minimize 
movement of item. 
Original packaging 
sealed with item. 


Item# 

Description 

Recovered By 

Observed By 

Date Found 

8 

Wire with Black Cloth 

-1 

I_L 

4/18/2012 


Where Found 

Packaging/Marking 

Grid 

Room/Area 

Comments 

In evidence item #1 

Tvek bag (Indirect) 



There appear to be 
hairs attached to this 

item. 


Item# 

Description 

Recovered By 

Observed By 

Date Found 

9 

Bipod 

I r~ 


r 

4/18/2012 


Where Found 

Packaging/Marking 

Grid 

Room/Area 

Comments 

In evidence item #1 

Cardboard Box 

(Indirect) 



Evidence repackaged to 
minimize movement of 
item. Original 
packaging sealed with 

item. 


Item# 

Description 

Recovered By 

Observed By 

Date Found 

10 

Bag of Damprid 

1 1 

1_ 1 

4/18/2012 


Where Found 

Packaging/Marking 

Grid 

Room/Area 

Comments 

In evidence item #1 

Tvek bag (Indirect) 





Item# 

Description 

Recovered By 

Observed By 

Date Found 

11 

4 Empty magazines 

1 -1 

i -r 

4/18/2012 


Where Found 

Packaging/Marking 

Grid | Room/Area 

Comments 
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In evidence item #1 


Kpac (Indirect) 


Evidence repackaged to 
minimize movement of 
these items. Original 
packaging sealed with 
these items. 


Item# 

Description 

Recovered By 

Observed By 

Date Found 

12 

3 Loaded .22 caliber 

magazines 

1 .1 

1 1 

4/18/2012 




Where Found 

Packaging/Marking 

Grid 

Room/Area 

Comments 

In evidence item #1 

Kpac (Indirect) 



Evidence repackaged to 
minimize movement of 
these items. Original 
packaging sealed with 

these items. 


Item # 

Description 

Recovered By 

Observed By 

Date Found 

13 

Box of Griprite fasteners, 

21/2 inch screws 

1 

1 

4/18/2012 




Where Found 

Packaging/Marking 

Grid 

Room/Area 

Comments 

In evidence item #1 

Kpac (indirect) 



Evidence repackaged to 

minimize movement of 

item. Original 
packaging sealed with 

item. 


Item # 

Description 

Recovered By 

Observed By 

Date Found 

14 

1 Box Remington 

SubSonic .22 Caliber 

Long Rifle Hollow Point 
Ammunition and 2 boxes 

Federal Champion .22 
Caliber Long Rifle 
Ammunition 

1-1 

1 1 

4/18/2012 




Where Found 

Packaging/Marking 

Grid j Room/Area 

Comments 
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EVIDENCE RECOVERY LOG 


In evidence item #1 


Kpac (Indirect) 


Evidence repackaged to 
minimize movement of 
these items. Original 
packaging sealed with 
these items. 


Item# 

Description 

Recovered By 

Observed By 

Date Found 

15 

19 rounds loose .22 

caliber ammunition 

1 .1 

1 1 

4/18/2012 




Where Found 

Packaging/Marking 

Grid 

Room/Area 

Comments 

In evidence item #1 

Kpac (Indirect) 

' 


Evidence repackaged to 
minimize movement of 
items. Original 
packaging sealed with 

these items. 


Item # 

Description 

Recovered By 

Observed By 

Date Found 

16 

Black Handle with Metal 

Clip 

1 1 

1 

4/18/2012 




Where Found 

Packaging/Marking 

Grid 

Room/Area 

Comments 

In evidence item #1 

Kpac (Indirect) 



Evidence repackaged to 

minimize movement of 

item. Original 
packaging sealed with 

item. 


Item # 

Description 

Recovered By 

Observed By 

Date Found 

17 

Black Flashlight Maglite 

i r 

1 L 

4/18/2012 


Where Found 

Packaging/Marking 

Grid 

Hoom/Area 

Comments 

In evidence item #1 

Cardboard Box 
(Indirect) 
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BLAKE FALLS RESERVOIR - PAR1SHVILLE, NEW YORK 
APR 18, 2012 08:10 AM 
7A-AN-15642 


PHOTOGRAPHIC LOG 


Photo Log 

Camera _ 

Nikon D700 


Roll Photo Item # Type _Sea 

1 1 Digital N 

Media 

_ Range Photo Subject 

Overall Other Photo 

Comments - 



Nikon D700 1 2 

Digital N 

Media 

Photographer 

Range Photo Subject 

1 . 1 

Overall Other Photo 


Comments 

Boat Launch from Road - East 



Camera Roll Photo 

Item # Type Seal 

Nikon D700 1 3 

Digital N 

Media 

Photographer 

Range Photo Subject 

i 

Overall Other Photo 



Boat Launch from Road - 

Northeast 
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Camera 

Roil 

Photo 

Item# 

Type 

Sea 

Nikon D700 

1 

5 


Digital 

Media 

N 

Photographer 

Range 

Photo Subject 

1 

Overall 

Other Photo 


Comments 

Boat Launch from Road - 
North/Northwest 



Camera 

Roll 

Photo 

Item # 

Type 

Sea 

Nikon D700 

1 

6 


Digital 

Media 

N 

Photoqrapher 

Range 

Photo Subject 

1 

Overall 

Other Photo 

Description 

Comments 

Boat Launch from Road - 
North/Northwest 
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PHOTOGRAPHIC LOG 



Camera 

Roll 

Photo 

Item # 

Type 

Scale 

Nikon D700 

l 

14 


Digital 

Media 

N 

Photographer 

Range 

Photo Subject 

1 1 

Overall 

Other Photo 

Description 

Comments 

Gravel drive to boat launch - 

East 




Camera 

Roll 

Photo 

item # 

Type 

Scale 

Nikon D700 

1 

15 


Digital 

Media 

N 

Photographer 

Range 

Photo Subject 

1 ~ 1 

Overall 

Other Photo 

Description 

Comments 

Gravel Drive to boat launch - 

South 
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PHOTOGRAPHIC LOG 



Camera 

Roil 

Photo 

Item# 

Type 

Scale 



Nikon D700 

1 

17 


Digital 

Media 

N 

PTWR- 

; f 

Photographer 

Range j Photo Subject 

i 

Overall | Other Photo 

.Description_ 

Gravel Drive to boat launch - 

southwest 

■Comments_ 




Camera 

Roil 

Photo 

item # 

Type 

Scale 

Nikon D700 

1 

18 


Digital 

Media 

N 

Photographer 

Range 

Photo Subject 

-r~ 

Overall 

Other Photo 

Description . 

Comments 

Boat Launch - Southeast 
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BLAKE FALLS RESERVOIR - PAR1SHVILLE, NEW YORK 
APR 18,2012 08:10 AM 
7A-AN-15642 


PHOTOGRAPHIC LOG 


Nikon D700 1 19 

Digital N 

Media 

Photographer 

Range Photo Subject 

1 - 1 - 

Overall Other Photo 

Description_ 

Boat launch on gravel drive - 

south 

Comments 


Camera Roll Photo 

Nikon D700 1 20 

Photographer 

1 1 

DescriDtion 

Boat Launch on gravel drive - 
southwest 

Item# Type j Sea 

Digital N 

Media 

Range Photo Subject 

Overall Other Photo 

Comments 


Camera Roll Photo 

Nikon D700 1 21 

Photographer 

Description_ 

Boat launch on gravel drive - 

southwest 

item # Type Sea 

Digital N 

Media 

Range Photo Subject 

Overall Other Photo 

Comments 
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PHOTOGRAPHIC LOG 



Camera 

Roll 

Photo 

item # 

Type 

Scale 

Nikon D700 

1 

23 


Digital 

Media 

N 

Photographer 

Range 

Photo Subject 

1 

Overall 

Other Photo 

Description 

Comments 

Area to south of concrete pad 
by water 




Camera 

Roll 

Photo 

item# 

Type 

Scale 




Nikon D700 

1 

24 


Digital 

Media 

N 


Photographer 

Range 

Photo Subject 

1 1 

Overall 

Other Photo 

1 

. .* * * j • ** 

■ ■ : 

Description 

Comments 

Area to south of concrete pad 
with no swimming sign 
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BLAKE FALLS RESERVOIR - PARISHV1LLE, NEW YORK 
APR 18, 2012 08:10 AM 
7A-AN-15642 


PHOTOGRAPHIC LOG 


Camera Roil Photo 

item # Type Seal 

Nikon D700 1 25 

Digital N 

Media 

Photographer 

Range Photo Subject 

1 1 

Overall Other Photo 



Area between gravel drive 

and creek - south 



Camera Roil Photo 

Item # Type Seal 

Nikon D700 1 26 

Digital N 

Media 

Photographer 

Range Photo Subject 

i 

Overall Other Photo 

Description_ 

Area between gravel drive 
and creek - south 

Comments 


Camera Roll Photo 

Item # Type Seal 

Nikon D700 1 27 

Digital N 

Media 

Photographer 

Range Photo Subject 

.r: j i 

Overall Other Photo 

Description_ 

Area between gravel drive 
and creek - facing east 

Comments 
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BLAKE FALLS RESERVOIR - PAR1SHVILLE, NEW YORK 
APR 18, 2012 08:10 AM 
7A-AN-1S642 


PHOTOGRAPHIC LOG 


Camera Roll Photo 

Item # Type Sea 

Nikon D700 1 28 

Digital N 

Media 

Photographer 

Range Photo Subject 

1 

Overall Other Photo 

Area between gravel drive 
and creek - facing east 

_C- 0 .CPffl.en.ts_ 


Camera Roll Photo 

Nikon D700 1 29 

Item # Type Sea 

Digital N 

Media 

Photographer 

Range Photo Subject 

I - 

Overall Other Photo 



Area between gravel drive 
and creek - facing southeast 



Camera Roll Photo 

Item # Type Sea 

Nikon D700 1 30 

Digital N 

Media 

Photographer 

Range Photo Subject 

1 

Overall Other Photo 



Area between gravel drive 
and creek - facing 
south/southeast 


Page 20 of 73 












BLAKE FALLS RESERVOIR - PARISH VILLE, NEW YORK 
APR 18, 2012 08:10 AM 
7A-AN-15642 
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PHOTOGRAPHIC LOG 



fa6 

b7C 


Camera 

Roil 

Photo 

Item # 

Type 

Scale 

Nikon D700 

1 

35 


Digital 

Media 

N 

Photographer 

Range 

Photo Subject 

1 1 

Overall 

Other Photo 

DescriDtion 


Area between gravel drive 
and creek - facing southeast 




Camera 

Roll 

Photo 

Item # 

Type 

Scale 

Nikon D700 

1 ' 

36 


Digital 

Media 

N 

Photographer 

Range 

Photo Subject 

1 1 

Overall 

Other Photo 



Area between gravel drive 
and creek - facing south 
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BLAKE FALLS RESERVOIR - PARISHVILLE, NEW YORK 
APR 18, 2012 08:10 AM 


PHOTOGRAPHIC LOG 


Nikon D700 1 37 

Digital N 

Media 

Photographer 

Range Photo Subject 

- 

Overall Other Photo 

Area between gravel drive 
and creek - south/southwest 



Camera Roll Photo 

Item # Type Sea 

Nikon D700 1 38 

Digital N 

Media 

Photographer 

Range Photo Subject 

1 

Overall Other Photo 


Comments 

Area between gravel drive 

and creek-west 



Camera Roll Photo 

item# Type Sea 

Nikon D700 1 39 

Digital N 

Media 

Photographer 

Range Photo Subject 

1 

Overall Other Photo 

Description_ 

Area between gravel drive 

and creek-northwest 

-Comments___ 
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BLAKE FALLS RESERVOIR - PARISHVILLE, NEW YORK 
APR 18,2012 08:10 AM 
7A-AN-15642 


PHOTOGRAPHIC LOG 


Photo Subject 

Other Photo 


Description _ 

Area of creek entering 
reservoir facing south 



Area of creek entering 
reservoir facing south 


Photo Subject 

Other Photo 


Description _ 

Area of creek entering 
reservoir facing south 
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Camera 

Roil 

Photo 

Item# 

Type 

Sea 

Nikon D700 

1 

47 


Digital 

Media 

N 

Photographer 

Range 

Photo Subject 

1 

Overall 

Other Photo 


Comments 

Area of creek looking west 



Camera 

Roll 

Photo 

Item # 

Type 

Sea 

Nikon D700 

1 

48 


Digital 

Media 

N 

Photographer 

Range 

Photo Subject 

l 

Overall 

Other Photo 



Area of creek looking west 
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BLAKE FALLS RESERVOIR - PARISHVILLE, NEW YORK 
APR 18, 2012 08:10 AM 
7A-AN-15642 


PHOTOGRAPHIC LOG 


camera 

Nikon D700 


-1 

Overall | Other Photo 



Area near creek looking 
west/northwest 



Camera Roll Photo 

Item # Type Sea 

Nikon D700 1 50 

Digital N 

Media 

Photographer 

Range Photo Subject 

1 

Overall Other Photo 



Area near creek looking 
north/northwest 



Camera Roll Photo 

Item # Type Sea 

Nikon D700 1 51 

Digital N 

Media 

Photographer 

Range Photo Subject 

1 

Overall Other Photo 



Area near creek looking north 
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BLAKE FALLS RESERVOIR - PARISHVILLE, NEW YORK 
APR 18, 2012 08:10AIM 
7A-AN-15642 


PHOTOGRAPHIC LOG 


camera 

Nikon D700 


Photo Item# 

55 


Dg-8.PliP.tLQD_ 

Lake at boat launch area 
looking southeast. 



Nikon D700 1 56 

Digital N 

Media 

Photographer 

Range Photo Subject 

1 

Overall Other Photo 

Lake at boat launch area 

looking southeast. 



Roil Photo 

Camera 

Item # Type Seal 

Nikon D700 1 57 

Digital N 

Media 

Photographer 

Range Photo Subject 

1 1 

Overall Other Photo 



Lake at boat launch area 

looking southeast. 
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BLAKE FALLS RESERVOIR - PARtSHVILLE, NEW YORK 
APR 18,2012 08:10 AM 
7A-AN-15642 


PHOTOGRAPHIC LOG 


Nikon D700 1 61 

Digital N 

Media 

Photographer 

Range Photo Subject 

. 1 - 

Overall Other Photo 



Lake shore to south of boat 

launch with creek mouth. 



Camera Roll Photo 

item # Type Sea 

Nikon D700 1 62 

Digital N- 

Media 

Photographer 

Range Photo Subject 

. 1 7 

Overall Other Photo 

Description_ 

Large rocks just to south of 
boat ramp at water's edge 
looking east. 

Comments 


Camera Roll Photo 

Item # Type Sea 

Nikon D7G0 1 63 

Digital N 

Media 

Photographer 

Range Photo Subject 

1 

Description_ 

Large rocks just to south of 
boat ramp at water’s edge 
looking east. 

Overall Other Photo 
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BLAKE FALLS RESERVOIR - PARISHVILLE, NEW YORK 
APR 18,2012 08:10 AM 
7A-AN-15642 












BLAKE FALLS RESERVOIR - PARISHVILLE, NEW YORK 
APR 18, 2012 03:10 AWI 
7A-AN-15642 



Camera 

Roll 

Photo 

item# 

Type 

Sea 

Nikon D700 

1 

69 


Digital 

Media 

N 

Photographer 

Range 

Photo Subject 

1 

Overall 

Other Photo 


Comments 

View of creek from culvert. 
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BLAKE FALLS RESERVOIR - PARISHViLLE, NEW YORK 
APR 18,2012 08:10 AM 
7A-AN-15642 


PHOTOGRAPHIC LOG 


Nikon D700 1 70 


Description _ 

North bank of creek. 


Digital N 

Media 

~ Range Photo Subject 

Overall Other Photo 

Z-Comments_ 



Camera Roll Photo 

Item # Type Sea 

El 


Nikon D700 1 71 

'Digital N 

Media 



Photographer 

Range Photo Subject 


J 

- 

Overall Other Photo 



DescriDtion 

Comments 



North bank of creek. 




Camera Roll Photo 

Item # Type Sea 

m\ 

Nikon D700 1 72 

Digital N 

Media 

■ 

Photographer 

Range Photo Subject 


1 1 _ 

Overall Other Photo 

■ 

Description 

Comments 

m\ 

North bank of creek facing 

North west. 

















BLAKE FALLS RESERVOIR - PARISHVILLE, NEW YORK 
APR 18, 2012 08:10 AM 
7A-AN-15642 


PHOTOGRAPHIC LOG 


Camera Roll Photo 

Item # Type Sea 

Nikon D700 1 73 

Digital N 

Media 

Photographer 

Range Photo Subject 


Overall Other Photo 

Description___ 

North bank of creek facing 

North west. 



Camera Roll Photo 

Item # Type Sea 

Nikon D700 1 74 

Digital N 

Media 

Photographer 

Range Photo Subject 

- 1 - - 

Overall Other Photo 



North bank of creek 



Camera Roll Photo 

Item # Type Sea 

Nikon D700 1 75 

Digital N 

Media 

Photographer 

Range Photo Subject 


Overall Other Photo 

North bank of creek 

_C.ojTim.enls_ 
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Camera 

Roll 

Photo 

Item# 

Type 

Sea 

Nikon D700 

1 

80 


Digital 

Media 

N 

Photographer 

Range 

Photo Subject 

1 

Overall 

Other Photo 



Further south of photo 79 
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PHOTOGRAPHIC LOG 



I 

b6 j 
b7C 


Camera 

Roll 

Photo 

Item # 

Type 

Scale 


' 


Nikon D700 

1 

86 


Digital 

Media 

N 

■ ’ 99 WKr 

Ip&i 

Photographer 

Range 

Photo Subject 

1 1 

Overall 

Other Photo 

Descriotion 

Comments 

Facing south from road east 
of photo 85 



Camera 

Roll 

Photo 

Item # 

Type 

Scale 



Nikon D700 

1 

87 


Digital 

Media 

N 

lUf ' 

1 

Photographer 

Range 

Photo Subject 

1 1 

Overall 

Other Photo 

Descriotion 

Comments 

Facing south from road east 
of photo 86 
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PHOTOGRAPHIC LOG 


Camera 

Roll 

Photo 

Item # 

Type 

Scale 




Nikon D700 

1 

88 


Digital 

Media 

N 

Photographer 

Range 

Photo Subject 

1 1 

Overall 

Other Photo 

Descrtotion 

Comments 

Facing south from road east 
of photo 87 




Camera 

Roll 

Photo 

Item# 

Type 

Scale 

Nikon D700 

1 

89 


Digital 

Media 

N 

Photographer 

Range 

Photo Subject 

l-1 

Overall 

Other Photo 



Facing south from road east 
of photo 88 




Camera 

Roll 

Photo 

Item# 

Type 

Scale 

Nikon D700 

1 

90 


Digital 

Media 

N 

Photographer 

Range 

Photo Subject 

1 1 

Overall 

Other Photo 

DescriDtion 

Comments 

Facing south from road east 
of photo 89 
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Camera 

Roil 

Photo 

Item# 

Type 

Sea 

Nikon D70D 

1 

92 


Digital 

Media 

N 

Photographer 

Range 

Photo Subject 

-1 

Overall 

Other Photo 

Descrrotion 

Comments 

Same as photo 91, different 

exposure 
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Camera 

Roil 

Photo 

Item # j Type 

: Sea 

Nikon D700 

1 

95 

Digital 

Media 

; N 

Photographer 

Range 

! Photo Subject 

-1 

Overall 

Other Photo 

□escriDtion 

1 Comments_ 

Facing south moving east of 




photo 94 







Camera 

Roll 

Photo 

item# 

Type 

Sea 

Nikon D700 

1 

96 


Digital 
| Media 

N 

PhotoaraDher 

Range 

Photo Subject 

1 

Overall 

Other Photo 



Facing south moving east of 
photo 95 
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BLAKE FALLS RESERVOIR - PARISH VILLE, NEW YORK 
APR 18, 2012 08:10 AM 
7A-AN-15642 


PHOTOGRAPHIC LOG 


Nikon D700 1 100 

Photographer 

I 

Description _ 

Standing north side of creek 
facing west (20 feet from 
lake) 


Photo Subject 
Other Photo 



Camera 

Nikon D700 


Photo item # 

101 


Photo Subject 

Other Photo 


Description _ 

Standing north side of creek 
facing west (35 feet from 
lake) 



Camera 

Roll 

Photo 

item# 

Type 

Scale 

Nikon D700 

1 

102 


Digital 

Media 

N 

Photographer 

Range 

Photo Subject 

—i i 

Overall 

Other Photo 

_D_e.S-Cnpti.on_ 

Standing north side of creek 

comments_ 


facing west (60 feet from 




lake) 








iHj 
tus. 
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BLAKE FALLS RESERVOIR - PARISHVILLE, NEW YORK 
APR 18,2012 08:10 AM 
7A-AN-15642 


PHOTOGRAPHIC LOG 


Camera _ 

Nikon D700 


Description _ 

Close up of culvert pipe 


Photo Item # Type 

103 Digital 

Media 

Range 

Medium 

Comments _ 


Photo Subject 

Other Photo 














BLAKE FALLS RESERVOIR - PARISHVILLE, NEW YORK 
APR 18,2012 08:10 AM 
7A-AN-15842 


PHOTOGRAPHIC LOG 


Camera Roll Photo 

item # Type Scale 

Nikon D700 1 106 

1 Digital N 

Media 

Photographer 

Range Photo Subject 

1 1 

Medium Evidence Item 

Description_ 

Rock covering bucket, 
medium view, looking south 

Comments___ 






Camera Roi! Photo 

Item # Type Scale 


Nikon D700 1 107 

1 Digital N 

Media 


Photographer 

Range Photo Subject 

. 

1 

Medium Evidence Item 


P.e.s.c.ription...__ 

Rock covering bucket, 4^ 

medium view, looking north. 

Comments 





Camera 

Nikon D700 


Photo Item # 

10S 1 


Photo Subject 

Evidence Item 


Rock facing north, medium 
range 
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Camera 

Roll 

Photo 

Item# 

: Type 

Scale 

Nikon D700 

1 

111 

1 

Digital 

Media 

N 

Photographer 

Range 

Photo Subject 

1 

Medium 

Evidence Item 

D esc notion 

Comments 

Removing smaller rocks 
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BLAKE FALLS RESERVOIR - PARISHVILLE, NEW YORK 
APR 18, 2012 08:10 AM 
7A-AN-15642 


PHOTOGRAPHIC LOG 






Camera Roll 

Item # 

Type Scale 

Nikon D700 1 

115 

1 

Digital N 

Media 

Photographer 

Range 

Photo Subject 

-1 

Medium 

Evidence Item 

Description_ 

Shot of bucket 

_C.omme.njs_ 


Camera 

Nikon D700 


Photo Item # 

116 1 


Description _ 

Bucket (with scale) 


Photo Subject 

Evidence Item 


Camera _ 

Nikon D700 


Photo Subject I 

Evidence Item 


Description _ 

Bucket removed (with scale) 
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Camera 

Roll 

Photo 

Item # 

Type 

Scaie 

Nikon D700 

1 

120 

1 

Digital 

Media 

Y 

Photographer 

Range 

Photo Subject 

! _ 

Medium 

Evidence item 

Description . 

Comments 

Bucket with ID# 
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BLAKE FALLS RESERVOIR - PARISHVILLE, NEW YORK 
APR 18, 2012 08:10 AM 
7A-AN-15642 


PHOTOGRAPHIC LOG 


Camera 

Nikon D700 


Photo Item# 
121 


Description _ 

Telephone Pole "A" tags 


Range Photo Subject 

Close Other Photo 

Comments _ 

See Sketch with telephone 
pole A depicted. 



Nikon D700 1 122 

Digital N 

Media 

Photographer 

Range Photo Subject 

1 

Close Other Photo 



NM144 tag, telephone pole A 



Camera Roll Photo 

Item # Type Seal 

Nikon D700 1 123 

Digital N 

Media 

Photographer 

Range Photo Subject 

1 - 

Close Other Photo 



Date tags (years), telephone 
pole A 
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BLAKE FALLS RESERVOIR - PAR1SHVILLE, NEW YORK 
APR 18,2012 08:10 AM 


PHOTOGRAPHIC LOG 


Camera Roll Photo 

Item # Type Scale 

Nikon D700 1 124 

Digital N 

Media 

Photographer 

Range Photo Subject 

1 

Overall Other Photo 



North from top of rock where 
evidence found. 



Camera Roll Photo 

Item # Type Scale 

Nikon D700 1 125 

Digital N 

Media 

Photographer 

Range Photo Subject 

1 

Overall Other Photo 


Comments 

Reference Point B. 

See sketch for reference point 

B 


Camera Roll Photo 

Item # Type Scale 

Nikon D700 1 126 

Digital N 

Media 

Photographer 

Range Photo Subject 

1 1 

Overall Other Photo 

Looking north from reference 
point B 

Comments 

See sketch for reference point 

B 
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BLAKE FALLS RESERVOIR - PARISHVILLE, NEW YORK 
APR 18, 2012 08:10 AM 
7A-AN-15642 


PHOTOGRAPHIC LOG 


Camera Roli Photo 

Item # Type Scale 

Nikon 0700 1 127 

1 Digital N 

Media 

Photographer 

Range Photo Subject 

1 

Overall Evidence Item 

Opened bucket 

Co IT1 IT! G MtS 


Camera Roil Photo 

Item # Type Scale 

Nikon D700 1 128 

1 Digital N 

Media 

Photoqrapher 

Range Photo Subject 

1 

Medium Evidence Item 

Same as photo 127 



Camera Roli Photo 

Item # Type Scale 

Nikon 0700 1 129 

1 Digital Y 

Media 

Photographer 

Range Photo Subject 

- 1 - 

Medium Evidence Item 

Description_ 

With scale 

Comments 
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BLAKE FALLS RESERVOIR • PARISHVILLE, NEW YORK 
APR 18, 2012 08:10 AM 
7A-AN-15642 


PHOTOGRAPHIC LOG 


j Roll | Photo 1 item # | Type 


Photo Subject 
Evidence Item 


Description _ Comments _ 

Black Dog Machine LLC AR15 Reverse side 

.22 Conversion 50RD 


Camera Roli Photo Item # Type 

Nikon D700 1 134 3 Digital 


Photo Subject 

Evidence Item 


Black plastic tube/silencer 


j Roll | Photo ] item # [ Type 


Photo Subject 

Evidence Item 


De s cri p tio n_ 

Black plastic tube/silencer 
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PHOTOGRAPHIC LOG 


Camera 

Roll 

Photo 

Item# 

Type 

Scale 

Nikon D700 

1 

136 

3 

Digital 

Media 

Y 

Photographer 

Range 

Photo Subject 

1 1 

Close 

Evidence Item 


Comments 

Black plastic tube/silencer 





Camera 

Roll 

Photo 

Item # 

Type 

Scale 

Nikon D700 

1 

138 

3 

Digital 

Media 

Y 

Photographer 

Range 

Photo Subject 

1 1 

Close 

Evidence Item 


Comments 

Black plastic tube/silencer 

Different angle 
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Camera 

Roll 

Photo 

Item# 

Type 

Scale 

Nikon D700 

1 

140 

4 

Digital 

Media 

Y 

Photoqrapher 

Range 

Photo Subject 

1 

Close 

Evidence Item 

Description 

Comments 

Ruger 22 Charger Serial 

Number 490-36145 Trigger 
Mechanism and TruGlo Scope 
atlac.hed_andJSMn_Partjwjtji_ 



Camera 

Roll 

Photo 

Item # 

Type 

Scale 

Nikon D700 

1 

141 

4 

Digital 

Media 

Y 

Photographer 

Range 

Photo Subject 

1 

Close 

Evidence Item 

Description 

Comments 

Ruger 22 Charger Serial 

Number 490-36145 Trigger 
Mechanism and TruGlo Scope 
attached and Gun Part with 
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PHOTOGRAPHIC LOG 


Camera 

Roil 

Photo 

item # 

Type 

Scale 

Nikon D700 

1 

142 

4 

Digital 

Media 

Y 

Photographer 

Range 

Photo Subject 

1 

Close 

Evidence Item 

Description 

Comments 

Ruger 22 Charger Serial 

Number 490-36145 Trigger 
Mechanism and TruGlo Scope 

attached and Gun Part with 

Reverse side 



Camera 

Roll 

Photo 

Item # 

Type 

Scale 

Nikon D700 

1 

143 

5 

Digital 

Media 

N 

Photographer 

Range 

Photo Subject 

1 1 

Close 

Evidence Item 

Description 

Comments 

Ruger Model 10/22 Carbine 
.22 L.R. Caliber Serial Number 

111-23612 minus stock also 

includes Simmons Scone 




Camera 

Roll 

Photo 

Item # 

Type 

Scale 

Nikon D700 

i 

144 

5 

Digital 

Media 

Y 

Photographer 

Range 

Photo Subject 

1 1 

Close 

Evidence Item 


Comments 

Ruger Model 10/22 Carbine 
.22 L.R. Caliber Serial Number 

111-23612 minus Stock also 

Jn.cIud.es.S.imrn.on.s_S.coj)e_ 
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PHOTOGRAPHIC LOG 


Camera 

Roll 

Photo 

item# 

Type 

Scale 

Nikon D700 

1 

145 

5 

Digital 

Media 

Y 

Photographer 

Range 1 Photo Subject 

1 i - 

Close ] Evidence item 

Description 

Comments 

Ruger Model 10/22 Carbine 
.22 L.R. Caliber Serial Number 

111-23612 minus Stock also 

includes Simmons Scope_ 

Zip tied 



Camera 

Roll 

Photo 

item # 

Type 

Scale 

Nikon D700 

1 

146 

5 

Digital 

Media 

Y 

Photographer 

Range 

Photo Subject 

1 1 

Close 

Evidence Item 

Description 

Comments 

Ruger Model 10/22 Carbine 
.22 L.R. Caliber Serial Number 

111-23612 minus Stock also 

includes Simmons ScoDe 

Reverse side 



Camera 

Roli 

Photo 

item # 

Type 

Scale 

Nikon D700 

1 

147 

6 

Digital 

Media 

N 

Photographer 

Range 

Photo Subject 

1 1 

Close 

Evidence Item 

Description 

Comments 

Plastic Stock with Sling 
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BLAKE PALLS RESERVOIR - PARIS nVILLE, NEW YORK 
APR 18, 2012 08:10 AM 
7A-AN-15642 


PHOTOGRAPHIC LOG 


Camera _ 

Nikon D700 


Photo Item# 
I 148 (6 


Description_ 

Plastic Stock with Sling 


Photo Subject 

Evidence Item 


W* .fa 

1 1 -Ml 

H Si 

1 v W 


S ^1 


Camera 

Nikon D700 


Photo Item # 

149 6 


Description _ 

Plastic Stock with Sling 


Photo Subject 


Evidence Item 


( Comments 

Reverse side 


Camera _ 

Nikon D700 


Photo Item # 

”150 7 


Description _ 

Wood Stock with Sling 


Photo Subject 

Evidence Item 
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■ BLAKE FALLS RESERVOIR - PARISHVILLE, NEW YORK 
APR 18, 2012 08:10 AM 
7A-AN-15642 


PHOTOGRAPHIC LOG 

















BLAKE FALLS RESERVOIR - FARISHVILLE, NEW YORK 
APR 18, 2012 08:10 AM 
7A-AN-15842 


PHOTOGRAPHIC LOG 


Camera 

Roll 

Photo 

Item# 

Type 

Scale 

Nikon D700 

1 

154 


Digital 

Media 

N 

Photographer 

Range 1 Photo Subject 

I I : 

Close | Other Photo 

Description 

Comments 

Hair on evidence item 8 




b6 

b7C 



Camera 

Roll 

Photo 

Item# 

Type 

Scale j 

Nikon D700 

1 

156 


Digital 

Media 

Y 

Photographer 

Range 

Photo Subject 

1 r~ 

Close 

Other Photo 

Description __ _ 

Comments 

Hair on evidence item 8 
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BLAKE FALLS RESERVOIR - PAR1SHVILLE, NEW YORK 
APR 18,2012 08:10 AM 
7A-AN-15642 


PHOTOGRAPHIC LOG 


Description _ 

Bag of Damprid 


Camera _ 

Nikon D700 


DgscripiLoj}_ 

Bag of Damprid 


10 Digital N 

Media 

Range I I’hoto Subject - 

Close Evidence Item 


I Roll ] Photo j item # | Type 


Photo Subject 

Evidence Item 



Photo Item # Type _ Scale 

165 10 Digital Y 

Media 

_ Range Photo Subject" 

Close Evidence Item 

Comments _ 

Reverse side 
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BLAKE FALLS RESERVOIR - PARISHVILLE, NEW YORK 
APR 18, 2012 08:10 AM 


PHOTOGRAPHIC LOG 


Photo Item # Type _ Scale 

166 11 Digital N 

Media 

"Range Photo Subject 

Close Evidence Item 


4 Empty magazines 





Photo Subject 

Evidence Item 


4 Empty magazines 


Camera 

Nikon D700 


Photo Item # Type 

~168 11 Digital 

Media 


Photo Subject 




















BLAKE FALLS RESERVOIR - PARISHVILLE, NEW YORK 
APR 18, 2012 08:10 AM 
7A-AN-15642 


PHOTOGRAPHIC LOG 


Camera _ Roil 

Nikon D700 1 


Description _ 

3 Loaded .22 caliber 


Photo Item # Type 

169 12 Digital 

Media 

Range _ 

Close 

_ Comments _ 


Photo Subject 

Evidence Item 


Camera Roll Photo 

Item # Type Scale 

Nikon D700 1 170 

12 Digital Y 

Media 

Photographer 

Range Photo Subject 

-1 

Close Evidence Item 



3 Loaded .22 caliber 

magazines 



Camera Roll Photo 

Item # Type Scale 

Nikon D700 1 171 

12 Digital Y 

Media 

Photoqrapher 

Range Photo Subject 

' l. 

Close Evidence Item 

Description_ 

3 Loaded .22 caliber 

magazines 

Comments 

Reverse side 
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BLAKE FALLS RESERVOIR - PARISHVILLE, NEW YORK 
APR 18, 2012 08:10 AM 


PHOTOGRAPHIC LOG 


Camera 

Roll 

Photo 

Item# 

Type 

Scale 

Nikon D700 

1 

172 

13 

Digital 

Media 

N 

Photographer 

Range 

Photo Subject 

1 1 

Close 

Evidence Item 



Box of Griprite fasteners, 2 

1/2 inch screws 




b6 

b7C 



Camera 

Roll 

Photo 

Item# 

Type 

Scale 

Nikon D700 

1 

174 

13 

Digital 

Media 

Y 

Photographer 

Range 

Photo Subject 

1 

Close 

Evidence Item 

Descriotion 

Comments 

Box of Griprite fasteners, 2 

1/2 inch screws 

Reverse side 
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Camera 

Roll 

Photo 

Item# 

Type 

Scale 

Nikon D700 

1 

175 

14 

Digital 

Media 

N 

Photographer 

Range 

Photo Subject 

1 T~ 

Close 

Evidence Item 


Comments 

1 Box Remington StibSonic .22 
Caliber Long Rifle Hollow 

Point Ammunition and 2 

_boxes_FederaLCh.ampion._.22._ 




Camera 

Roll 

Photo 

Item # 

Type 

Scale 

Nikon D700 

1 

176 

14 

Digital 

Media 

y 

Photographer 

Range 

Photo Subject 

i r 

Close 

Evidence Item 

Desc notion 

Comments 

1 Box Remington SubSonic .22 
Caliber Long Rifle Hollow 

Point Ammunition and 2 

boxes Federal Chamoion .22 




Camera 

Roil 

Photo 

item# 1 Type 

Scale 

Nikon D700 

1 

177 

14 Digital 

| Media 

Y 

Photographer 

Range 

Photo Subject 

1 ^ 

Close 

Evidence Item 

Description 

Comments 

1 Box Remington SubSonic .22 
Caliber Long Rifle Hollow 

Point Ammunition and 2 

-bme.sJEejjeraLCb.a.mpionJ?:2_ 

Side view 
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BLAKE FALLS RESERVOIR - PARtSHVILLE, NEW YORK 
APR 18, 2012 08:10 AM 


PHOTOGRAPHIC LOG 


Roll Photo 

1 178 


DfiSPliPllOD_ 

19 rounds loose .22 caliber 


Photo Subject 

Evidence Item 


Photo Subject 

Evidence Item 


19 rounds loose .22 caliber 


Photo Subfect 

Evidence Item 


Black Handle with Metal Clip 
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PHOTOGRAPHIC LOG 


| Roil | Photo | Item# | Type 


Black Handle with Metal Clip 


| Roll | Photo | Item # [ Type 


Photo Subject 
Evidence Item 


Black Handle with Metal Clip Reverse side 


Type Scale 

Digital N 

Media 

Photo Subject - 

Evidence Item 


Black Flashlight Maglite 
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BLAKE FALLS RESERVOIR - PARISHVILLE, NEW YORK 
APR 18, 2012 08:10 AM 
7A-AN-15642 


PHOTOGRAPHIC LOG 


Camera Roll Photo 

Item # Type Scale 

Nikon D700 1 184 

17 Digital Y 

Media 

Photographer 

Range Photo Subject 

1 1 

Close Evidence Item 

Black Flashlight Maglite 



Camera Roll Photo 

Item # Type Scale 

Nikon D700 1 185 

17 Digital Y 

Media 

Photographer 

Range Photo Subject 

1 1 

Close Evidence Item 

Black Flashlight Maglite 

Reverse side 


Camera Roll Photo 

Item # Type Scale 

Nikon D700 1 186 

1 Digital N 

Media 

Photoaraoher 

Range Photo Subject 

1 1 T - 

Close Evidence Item 

Home Depot Bucket 

Empty bucket 
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7-3 (&ev. 7-i<W6) 


UNCLASSIFIED 


9 



w? FBI Laboratory 


2501 Investigation Parkway 
Quantico, Virginia 22135 


To: 


Anchorage 

sa [- 


Date: May 2, 2012 
Case ID No.: 306-AN-15642 
Lab No.: 120501015 PF 


b6 



Reference: Communication dated April 27,2012 
Your No.: 


Title: ISRAEL KEYES; 

SAMANTHA TESSLA KOENIG - VICTIM; 

ETAL; ■ 

SERIAL KILLINGS - VIOLENT CRIMINAL THREAT 


Date specimens received: May 1,2012 

The FBI Laboratory has received your request for examination. The accompanying 
items of evidence have been inventoried. The provided listing and description of the submitted 
items may be subject to change when the examination phase begins. If changes are made, they 
will be reflected in the Report of Examination issued by the examiner making the change. 

Specimens: 

K1 Taurus revolver, Serial Number CY51304 (1B24, E5123093) 

K2 Smith & Wesson pistol. Serial Number PBA6901 (1B25, E5123094) - 

Each examiner assigned to your request will issue a separate Report of Examination 
that will address the results of his/her expertise. For tech nical questions, c ontact the following 
unit(s) assigned to your ease: Firearms/Toolmarks Unit- | | 


UNCLASSIFIED 


15^43; \iA rn 




UNCLASSIFIED 


t 


t 


If there is. a change in the status of your investigation that would have an affect on the 
prioritization of your request, such as court deadlines, dismissal of charges, or gui lty plea s; or if 
you have questions regarding the status of your case, contact Request Coordinator ! I 


b6 

b7C 


Page 2 of2 
120501015 PF 


UNCLASSIFIED 



♦♦ 


UNCLASSIFIED 


aD6?-AKl-l5^45;lii5 

\0<&\c^wo3ec 



















UNCLASSIFIED 


30MH-I5649;l4>k 
















b6 

b7C 



NAME^t^EYES, Israel 


AKA: 




DOB: 01/07/1978 


HAIR: Brown 


HEIGHT: 6 *- 2 ” 


ADL: 7268639 


SSN: 127-86-4049 


FELON: No 


SEX: Male 


EYES: Brown 


WEIGHT: 190 


APSIN: 7393527 


FBI: 67623PD9 


GANG: None 


RED FLAGS: 


WSIN ENTRY DATE: 


INFO LAST UPDATED ON: 


ADDRESSES: 


2456 Spurr Ln., Anchorage, AK (01/13/12) 

3705 Arctic Blvd. #2891, Anchorage, AK (03/21/08) 



CRIM HISTORY: 1 

NCIC-03/14/12-Fraud - FBI RA Beaumont, TX 








VEHICLES: ! 

04 White Chev Silverado - AK Lie FTC990 

06 home made flat bed trailer - AL Lie 2989RT 









ASSOCIATES: 1 











NOTES: 










□ 







DPSDMVPhotoWeb - DLImage 


https://acjis.dj^®te.ak.os/DPSDMVPhotoWeb/DLSelectForm.aspx 



r l ;: I; II ' . ! ! I i 



OLN: 

7268639 New Query 

SID: 

7393527 

Issued Date: 

01/13/2012 .Create LineUp 

Print Date: 

01/13/2012 11:41:42 

DOB: 

01/07/1978 

Sex: 

M 

Race: 


Hgt: 

74 

Wgt: 

190 

Eye: 

BRO 

Hair: 

BRO 

Donor: 

Y 

Expire; 

01/07/2017 

Dup No: 

0 

Class: 

D 

Endorsements: 


Restrictions: 

1 

Legal Age Date: 01/07/1999 

Empl. ID: 


Physical Loc: 

BENSON 

Print Loc: 

BENSON 

Cam. Open: 

BENCAM 

Lie. Lay. Typ: 

Driver License (over 21) 


Name: ISRAEL 


KEYES 


Digital Lie. ID: 1239145 OffWorkstatn: 6 

Employee Title: 

Restriction Comments: 

Age Msg: 

Mail 3705 ARCTIC #2891 

Address: ANCHORAGE, AK 99503 

Res 2456 SPURR LN 

Address: ANCHORAGE, AK 99517 


lofl 


3/26/2012 12:21 PM 






Page: 1 Document Name: untried 


PSTD300P TERMID: X424 


BASIC PERSON RECORD 
SYES 


PERSON NAME: ISRAEL 

.DOB: 01/07/19-^e SSN: 127-86-4049 PERM ID 

SEX: M HGT: 6 ' 2 WGT: 190 HAIR: BRO EYE COLOR: BRO RACE 

B]IRTH PLACE CITY; COVE V STATE: UT MONIKER: IFFS 

FP ON FILE: FELON: N SOR 


MOST CURRENT STREET/EXTRA Lffi 1 
MAILING ADDR: 3705 ARTIC BLVDV2891 
(VEH REG) 

RES ADDR: 2456 SPURR LN 
[ (DRIVER LIC) 

APSIN ID: 7393527 DL STATUS 
CLASS EXPIRES CLASS EXPIRES 

D 01/07/2017 


ADL: 7268639 
DMV ID: 7268639 


PF2 MULT PER 
PF8 GRIM HST 



04/23/12 


14:35:59.1 


CITY/COUNTRY 

ANCHORAGE 


ST LAST CHG 
AK 03/21/2008, 

AK 01/13/20li 


CDL STATUS: 

CLASS EXPIRES CLASS EXPIRES 


RESTRICTIONS 


PF3 FWP HST 


PF10 NCIC W/W 


CORR LENSES 


^F6 DMV VEH DIS PF7 DMV DR HST 
PF11 ADDR DISP 





Date: 4/23/2012 Time: 2:36:15 PM 








Page: 


1 Document Name: 





PSTD800P TERMID: X424 CRIMINAL CONVICTIONS 04/23/12 14:36:03.9 

PERSON NAME: ISRAEL KEYES 


UPDATED: AST NUM: APSIN ID: 7393527 FBI NUM: 

CRIMINAL HISTORIES MAY EXIST IN: 

FP CLASS: 


CONV CONV CONVICTING 

COURT DATE CHARGE 


COURT POS FEL ATN 

DOCKET ID 


* * * NO CRIMINAL CONVICTIONS FOR THIS PERSON * * * 


PF2 MULT PERSON PF8 FULL HIST 


* AT END * 


Date: 4/23/2012 Time: 2:36:18 PM 
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PSTD400P TERMID: X424 


CRIMINAL HISTORY 04/23/12 14:36:06.9 


PERSON NAME: ISRAEL KEYES 


DOB: 

01/07/1978 






SSN: 

127-86-4049 






SEX: 

M 

WEIGHT: 

190 

HEIGHT: 

6 02 

HAIR: BRO 

EYE COLOR: 

BRO 

RACE: 


SKIN: 



TEMPERAMENT: 


MARKS: 





BIRTH CITY: 

COVE 

STATE: 

UT 

COUNTRY: 



APSIN ID: 

7393527 

AST NUMBER: 



FBI 

NUMBER: 

CITIZEN: 


FELON: 

N SOR: DNA: 

FP 

ON FILE: 


MAILING 

ADDR: 

STREET/EXTRA LINE 

3705 ARTIC BLVD #2891 

CITY/COUNTRY 
ANCHORAGE 

STATE 

AK 

LAST CHGD 
03/21/2008 

RES 

ADDR: 

2456 SPURR LN 

ANCHORAGE 

AK 

01/13/2012 


OCCUPATION: EMPLOYMT: 

PER COMMENT: 

CH COMMENT: 

CH MAY EXIST IN: 

FP CLASS: 

PF2 MULT PERSON PF8 CONVICTIONS 


UPD: 

III STAT: 

MORE... 


Date: 4/23/2012 Time: 2:36:21 PM 







Page: 


1 Document Name: 


PSTD410P TERMID: X424 CRIMINAL HISTORY 

PERSON NAME: ISRAEL KEYES 


04/23/12 14:36:08.8 


* * * NO CRIMINAL HISTORY RECORDS FOR THIS PERSON * * * 


PF8 CONVICTIONS 


* AT END * 


Date: 4/23/2012 Time: 2:36:22 PM 




Page: 


1 Document Name: 




PSTD100P TERMID: X424 DMV VEHICLE INFORMATION 04/23/12 14:39:05.1 

OWNER: ISRAEL KEYES 


LICENSE: FTC990 SERIAL: 1GCHK29U34E318976 ■ I/M REQ: Y 


MODEL YEAR: 

2004 MAKE: 

CHEV 

MODEL: SLV 

STYLE: PK 

COLOR: 

ATC: 

WHI CLASS: 

2ND SERIAL: 

45 

UNLADEN WGT: 5699 

METHOD: A 

RESTRICT: Y 

EXPIRATION: 

09 2013 LIENHOLDER: 
STREET/EXTRA LINE 

: ALASKA USA FCU 

CITY/COUNTRY 

ST ZIP/DATE 

MAILING: 

3705 ARCTIC #2891 


ANCHORAGE 

AK 99503 

07/18/2011 

RESIDENCE: 

2456 SPURR LN 


ANCHORAGE 

AK 99517 

07/18/2011 

BASE ST: 

COUNTRY: 


PREY: ** 


************** STOLEN/STATUS INFORMATION ************* 
MSG: AGENCY: 


PF6 VEH SRCH PF7 LIEN PF10 XMIT TO NCIC PF11 TITLE 


Date: 4/23/2012 Time: 2:39:20 PM 







Page: 1 Document Name: unl^TCled 


PSTD100P TERMID: X424 DMV VEHICLE INFORMATION 04/23/12 14:39:00.3 


OWNER 

ISRAEL 

KEYES 





LICENSE 

2989RT 

SERIAL: 

WA98218 997 

I/M REQ 

: N 

MODEL YEAR 

2006 

MAKE: 

HMDE 

MODEL: 

STYLE 

: FB 

COLOR 

BLK 

CLASS: 

35 

UNLADEN WGT: 2000 

METHOD 

: A 

ATC 


2ND SERIAL': 



RESTRICT 

: Y 

EXPIRATION 

03 2012 

LIENHOLDER: 






STREET/EXTRA LINE 


CITY/COUNTRY 

ST 

ZIP/DATE 

MAILING; 

3705 ARTIC BLVD #2891 

ANCHORAGE 

AK 

99503 


03/21/2008 

RESIDENCE: 3705 ARTIC BLVD #2891 ANCHORAGE AK 99503 

03/21/2008 

BASE ST: COUNTRY: -PREV: WA 

************** STOLEN/STATUS INFORMATION ************* 
MSG: AGENCY: 


PF6 VEH SRCH PF7 LIEN PF10 XMIT TO NCIC PF11 TITLE 


Date: 4/23/2012 Time: 2:39:15 PM 







Page: 1 Document Name: 




PSTD100P TERMID: X424 DMV VEHICLE INFORMATION 

OWNER: ISRAEL KEYES 


04/23/12 14:38:53.1 


LICENSE: 
MODEL YEAR: 
COLOR: 
ATC: 
EXPIRATION: 

MAILING: 

RESIDENCE: 

BASE ST: 
******* 

J JUNKED/WRE 
J JUNKED/WRE 


FEX183 SERIAL:. E14GRHD2285 I/M REQ: Y 

1980 MAKE: FORD MODEL: F15 STYLE: PK 

BLU CLASS: 45 UNLADEN WGT: 3388 METHOD: A 

.2ND SERIAL: RESTRICT: Y 

08 2009 LIENHOLDER: 


STREET/EXTRA 

LINE 

CITY/COUNTRY 

ST 

ZIP/DATE 

3705 ARCTIC 

BLVD #2891 

ANCHORAGE 

AK 

99503 

08/24/2007 

134 W 12TH 


ANCHORAGE 

AK 

99501 

08/24/2007 


COUNTRY: 


PREV: 

WA 


******* STOLEN/STATUS INFORMATION ********** 
01/26/2010 MSG: TITLE SURR 2734865 AK METAL RE AGENCY: 
01/26/2010 ADI 


X4RY 

X4RY 


PF6 VEH'SRCH PF7 LIEN PF10 XMIT TO NCIC PF11 TITLE 


Date: 4/23/2012 Time: 2:39:08 PM 






Page: 1 Document Name: untTtled 


AKA/RONGCHAO, WEN 
AKA/WEN, RONG-CHAO 

NIC/W318109321 DTE/20100.208 1118 EST DLU/20110624 1256 EST 
IMMED CONFIRM WARRANT AND EXTRADITION WITH ORI 
NO NCIC WANT SOC/127864049 
NO NCIC WANT 0LN/7268639 


Date: 4/23/2012 Time: 2:37:31 PM 





Page: 1 Document Name: unl^TCled 


FROM NCIC ON 04/23/12 AT 14:39:42 
FL01AJU782N32700327 
AK0010100 

THIS INTERSTATE IDENTIFICATION INDEX RESPONSE IS THE RESULT OF YOUR 
RECORD REQUEST FOR FBI/67623PD9. THE FOLLOWING WILL RESPOND TO YOUR 
AGENCY: 

FBI - FBI/67623PD9 

END 


Date: 4/23/2012 Time: 2:40:00 PM 





Page: 1 Document Name: unt^rcled 


FROM NLETS ON 04/23/12 AT 14:39:42 

CR.WVFBINFOO 

15:39 04/23/2012 96635 

15:39 04/23/2012 48407 AK0010100 

*AJU782N327 

TXT 

HDR /2L01AJU782N3270 0327 

atnJ ~| 

********************** CRIMINAL HISTORY RECORD *********************** 
Data As Of 2012-04-23 

**************************** Introduction **************************** 
This rap sheet was produced in response to the following request: 

FBI Number 67623PD9 

Request Id AJU782N327 

Purpose Code ^3_ 

Attention [ j 

The information in this rap sheet is subject to the following caveats: 
This record is based only on the FBI number in your request-67623PD9. 
Because additions or deletions may be made at any time, a new copy 
should be requested when needed for subsequent use. (US; 2012-04-23) 

All arrest entries contained in this FBI record are based on 
fingerprint comparisons and pertain to the same individual. (US; 


Date: 4/23/2012 Time: 2:40:03 PM 





Page: 1 Document Name: uni^Kled 


2012-04-23) 

The use of this record is regulated by law. It is provided for official 
use only and may be used only for the purpose requested. {US; 

2012-04-23) 

*************************** IDENTIFI cation *************************** 


Subject Name(s) 

KEYES/ ISRAEL 
Subject Description 

FBI Number . State Id Number 

67623PD9 Unknown (XX) 

Social Security Number 
127864049 


Sex 
Male 
Height 
6 ' 02 ” 

Hair Color 

Brown 

Other) 

Place of Birth 
UT 

Fingerprint Images 

Photo Images 

Photo Image Available 


Race 

Unknown 

Weight 

190 

Eye Color 
Brown 

Citizenship 

US 


Date of Birth 

1978-01-07 

Fingerprint Pattern 

UC UC UC UC UC UC UC UC UC UC 


FBI-CJIS DIV-CLRKSBG CLARKSBURG WVFBINF00 


{ 



Date: 4/23/2012 Time: 2:40:04 PM 






Page: 1 Document Name: untiled 


Available Image Other 

(No Photo Image Transmitted 
Comment:FBI has two photos associated with 

arrest date of 2012/03/14) 

• Photo Image Available FBI RESIDENT AGENCY BEAUMONT TXFBIBT00 

Available Image Other 

(No Photo Image Transmitted 

Comment:Arresting agency has photo associated 

with arrest date of 2012/03/14) 

************************** CRIMINAL HISTORY ************************** 
Earliest Event Date 2012-03-14 


Arrest Date 
Arrest Case Number 
Arresting Agency 
Charge 

Charge Literal 
Agency 


2012-03-14 

TXFBIBT00 FBI RESIDENT AGENCY BEAUMONT 
01 

2699-FRAUD 

TXFBIBT00 FBI RESIDENT AGENCY BEAUMONT 


Severity 

************************* INDEX OF AGENCIES ************************** 
Agency FBI-CJIS DIV-CLRKSBG CLARKSBURG; WVFBINF00; 

Address 


1000 CUSTER HOLLOW RD 


Date: 4/23/2012 Time: 2:40:05 PM 








Page: 1 Document Name: unl^reled 


CLARKSBURG, WV 26306 


Agency FBI RESIDENT AGENCY BEAUMONT; TXFBIBT00; 

Address 

PO BOX 1070 

BEAUMONT, TX 777041070 
* * * END OF RECORD * * * 


Date: 4/23/2012 Time: 2:40:07 PM 





UNCLASSIFIED 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 04/30/2012 

To: Anchorage 

From: Anchorage 

Squad C-2 ._:__ 

Contact: SA b6 

_ , -1 b7c 

Approved By: 

Drafted By: 

Case ID #: ^fo6-AN-15642 (Pending) 

Title: ISRAEL KEYES; 

SAMANTHA TESSLA KOENIG - VICTIM; 

ET AL; 

SERIAL KILLINGS - VIOLENT CRIMINAL THREAT 

Synopsis: Report late filing of Accomplishment Report (FD-515). 

Details: An FD-515 .containing, information reaacding the, charging 

of Israel Keves, I __| 

[ was submitted after the expiration of 
the 3U-day deadline tor filing accomplishment reports. This was 
due to an oversight by the case agent and his involvement in the 
extensive exigent investigative follow-up and evidence collection 
efforts, including the continued search for Koenig, that were 
required immediately following the apprehension of Keyes. In 
addition, the U.S. At torney’s Office (USAO) fail ed to 
automatically, provide | | 

OTHER Sealed Pursuant to Court Order 


♦♦ 


UNCLASSIFIED 


t' 


I' M 


50k vlM-f 5643'J?l 


b6 

b7C 






^ Accomplishment Report 

(Accomplishment must be reported and loaded into 
ISRAA within 30 days from date of accomplishment) 


Dale Prepared <> , T /■?<?/ f'2~~ 
Date Loaded Sfalfl'OiD 


Drugs r 

ft Fugitive L 

Bankruptcy Fraud C 

Computer Fraud/Abuse E 

Corruption of Public Official C 
Money Laundering JT 

.t by FOts) |T 


File Number _ 


Investigative Assistance or Technique Used 

1. Used, but did not help 3. Helped, substantially 

2. Helped, minimally ' 4. Absolutely essential 

For Sub. Invest. Assist, by other FO(s) Indicate A. 8. C, D for corresponding FO 



A. Complaint / Information! Indictment 

■ JSypderal (QLocal □■Injemattonat 

Complaint Date: 0 ?/ 1 — 

CheckifCivilRIooComplalnt Q 
Information Date: 

IndlctmentDatet _ d??/ W -/* Z — 

B. Locate / Arrest 

^Federal FILocal □international 

Subject Priority: |Q A [Tj8 |Qc 


C. Summons Date:__ 

□ Federal Q Local' 

D. Recovery / Restitution / PELP X 
□Federal □ Local [T] International 

Recovery Date:;;_ • 

Code*_✓ Amount®_ 

Code *_✓ Amount S_ 

Restitution Date:_ 

Q Court Ordered ^Pretrial Diversion 

Code*_✓ Amounts_ 

PELP Date:_._ 

Code * ^ Amount S 

E. Hostages(s) Released Date:_ 

Released by:|T[]TerroristQ Other 
Number of Hostages: ' 


F. Conviction 

[Tj Federal Q Local □ International 

Conviction Date ; 


For 6F,'G, H-Indude Agency Code 
IT! Felony or PI Misdemeanor 

□ Plea or ‘ Q Trial 

State:_Judicial District:_ 

0, (J.S. Code Violation 
Required for sections A, B, F and J 
(Federal Only) 


H. Sentence Date:_ 

Sentence Type:_ 

In Jail: Years. 

Suspended: Years. 

Probation: Years. 

Fines: $_ 


Disruption Date:_ 

Dismantlement Date:_ 

Completion of FD-SISa Side 2 Mandatory 


J. Civil Rico Matters Date:_ 

Also complete “Section G“ 

Other Civil Matters Date:_:_ 

Judgment_• 

Judicial Outcome . _ . < 

Amount $_ 

Suspension' Years Months_ 

K. Administrative Sanction Date:_ 

Subject Description Code_* 

Type: Length: 

§ Suspension ^Permanent 
Debarment or 

injunction Year_Months— 

L. Asset Seizure Date:_ 

Asset Forfeiture Date:_ 

CATS # Mandatory_ 

Circle below one of the three asset forfeit! 
Admin, Civil Judicial, or Criminal 
Do not Indicate $ value in Section D 

M. Acquittal/ Dismissal/ Pretrial DIversloi 
(Circle one) Date:_ 


Drug Code __ 

Weight-Code!_ 

FDIN- 

Do not indicate $ in Section D 

O. Child Victim Information 
Child located /Identified Date:. 
|Q.lvlng ^Decease 


Name 

Race* Sex 

Dale of Birth 

Social Security No. (if available) 

A. fatf-cs 

b) A 

*tU i/mr 



m fAOC}, ibtan Organs Grim* (IOC), Russia 
ry, F'H 0S3ppTOpHal«, 

'CWO Program National Gang Stratagy target gro 


ian, Csnbbeen, orNigcrtsn Organized Como Grouj 
rogram National Pftorfty fnlikifc* target group - 


x Addition a I information may be added by attaching another form or a plaits sheet of paper for additional entries, 
a See codes on reverse side. 

* Requires that an explanation be attached and loaded Into ISRAA for recovery over $1 m and PELP over SS m. dt 






H I 1 F i ll 






For Further lost rue (tons See: MAOP, Part \l t Sections 3>5 thru 3-S,3. 
Revised 12-19-2006 


PROPERTY CODES 


agencycodes 


JUDICIAL QUTCOM 


02 Slo cks. Bonds or Negot- Instruments 

02 Genera) Retail Merchandise 

OS Heavy Machinery & Equipment 
06 Aircraft 

02 Vessels 

09 A«, Antiques or Rare Collection? 

11 Real Property 

20 All Other 

SENTENCE TYPES 

CP Capital Punishment 
JS Jail Sentence 

LP life Parole:. 

LS Ufc Sentence 

NS No Sentence (Subject is a Fugitive, 

Ins ane, has died, is a Corporation or 
roust pay fine only) 


AFOSI Air Force Office of Special Investigations 
AOS Army Criminal Investigative Service 

BATF Bureau of Alcohol, Tobacco & Firearms 

BJA Bn reau of Indian Affairs 

CBP Customs and Border Protection 

D CAA Defense Contract Audit Agency 

D CIS Defense Cri min at Investigative Service 

DEA Drug Enforcement Administration 

DOC Department of Corrections 

DOI Dep:> of Interior 

DHS Dept, of Homeland Security 

EPA Environmental Protection Agency 

FAA Federal Aviation Administration 

FDA Food and Drug Administration 

HHS Dept of Health A Human Services 

HUD Dept of Housing & Urban Development 

ICE Immigration and Customs Enforcement 

IRS Inremal'Rcvenue Service 

NASA Mart Aeronautics & Space Admin 

NB1S NafI NARC Border Interdiction 

NCI S Naval Criminal Investigative Service 


AG Agreement 

BR Baired/Removc 

CC Civil Contempt 

DC DisciphnatyCh 

FI Fine 

PJ Preliminary Inji 

PR Temporary Res 

PS Pre-filing Settle 

RN Restitution 

SP Suspension 

VR Voluntary Resi] 

OT Other 


SUBJECT PRIOR m 


A Subject wanted 


against another 
such a crime in 



















05/03/12 20 -.06:28 


Does Accomplishment Involve 


Drugs.: N 

A Fugitive.: N 

Bankruptcy Fraud.: N 

Computer Fraud/Abuse.: N 

Corruption of Public Officials: N 

Money Laundering.: N 



b7C 

b7E 


Sub. Invest. Asst by Other FOs: 

Investigative Assistance or Technique Used 


FI NAN ANALYST 
AIRCRAFT ASST 
COMPUTER ASST 
CONSEN MONITR 
ELSUR/FISC 
ELSUR/111 
ENG FIELD SUP 
ENG TAPE EXAM 
LEGATS ASST. 
EVIDNCE PURCH 
INFORMANT/CU 
LAB DIV EXAMS 


LAB FIELD SUP 
PEN REGISTERS 
PHOTO COVERGE 
POLYGRAPH 
SRCH WAR EXEC 
SHOW MONEY 
SOG ASST 
SWAT TEAM 
TECH AG/EQUIP 
TEL TOLL RECS 
UCO-GROUP I 
UCO-GROUP II 


UCO - NAT BACK[ 
NCAVC/VI-CAP 
CRIM/NS INTEL 
CRIS NEG-FED 
CRIS NEG-LOC 
ERT ASST 
BUTTE OSC 
SAV OSC 
POC SC 

FT. MON-NRCSC 
FOR LANG ASST 
NON FBI LAB EXl 


CART 

ASSET FORF PRO 

FORF SUPPORT P 

FFOS/CTD 

CXS/CTD 

INFRAGARD/CYD 

DFC/CID 


PPP 


= Used, but did not help 
= Helped, Minimally 
= Helped, Substantially . 
= Absolutely Essential 


FUSION CENTERS 


Complaint is for Federal/Local/International (F/L/I)... : F 

Civil Rico Complaint (Y/N).: N 

United States Code Violation 

Title Section Counts 

18 1029 1 


Accomplishment Narrative 


UNCLASSIFIED 
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Does Accomplishment Involve 


Drugs.: N 

A Fugitive.: N 

Bankruptcy Fraud.: N 

Computer Fraud/Abuse.: N 

Corruption of Public Officials: N 

Honey Laundering.: N 


Sub. Invest. Asst by Other FOs: 

Investigative Assistance or Technique Used 



b7C 

b7E 


KEYES, ISRAEL 


Squad Task Force 


1 = Used, but did not help 

2 = Helped, Minimally 

3 = Helped, Substantially 



U. S. Code Violation(s) 


Form FD-515a Side 2: Title Section Counts 

Subject's Role = . . . 

18 , 1029 1 


Subject's Criminal Activity : 

If Other, Specify. , . . ; 

If NON-LCN Member or Associate (H/A): 

Name of NON-LCN Criminal Group. . . : 

If La Cosa Nostra (LCN> Member or Asso CM/A): 
Name of LCN Organized Crime Group (OCG) . . . 
Position in LCN OCG.. 

Name of Union: 

Union Affiliation: 

If Other, Specify: 

Level of Union. . . . : 

If Local, Give Number: 

Position in Union.: 

If Other, Specify: 


Business Influenced/Affected: 

If Other, Specify.: 

Name of Company Subject connected with: 

Elected/Appointed Public Official Position: 
If Other, Specify. : 


Accomplishment Narrative 


UNCLASSIFIED 



































Date Prepared 


Investigative Assistance or Technique Used 1 - 

I, hut did net help 3. Helped, substantially 

ed, minimally A. Absolutely essential 

rest. Assist, by other FO(s) Indicate A, B, C, D for corresponding FO 


[Sub Invest Asst by FO(s) Q 

I Asst. FO(s>_I 

|_ A. B. C. D. 1 

[ Task Force 1 


A. Complaint / Information/ Indictment 

Local ^International 

Check if Civil Rico Complaint □ 

Information Date:_ — _ 

Indictment Date: — . 

B. Locate/Arrest 

[□Federal IHLocal FI International 
Subject Priority: Qa QB Qc 

Locate Date: _ 

Arrest Date: _ 

□ Subject Resisted Arrest 

n Subject Arrested was Armed 

C. Summons Date:_ 

□ Federal □local' 




F. Conviction 

□ Federal [] Local Q International 

Conviction Date:_ 

Subject Description Code_• (_)• 

For 6F, G, H-Indude Agency Code 

Felony or IH Misdemeanor 

□ Plea or O Trial 

State:_ Judicial District:_ 

6, U.S. Code Violation 
Required for sections A, B, F and J 
(Federal Only) 

Title Section # Counts 

/? , izex _ L_ 

tY rz-oz- _ l_ 

-t$L- JQ.V! —L 


Judgment_.__• 

Judicial Outcome_*x 

Suspension: Years_Months_ 

K, Administrative Sanction Date:_ 

Subject Description Code__* 

Type: Length: 

§ Suspension FHPermanent 

Debarment or 

Injunction Year_ Months_ 

L. Asset Seizure Data; 

Asset Forfeiture Data: 

CATS # Mandatory_ 

Cirde below one of the three asset forfeiture: 
Admin, Civil Judicial, or Criminal 
Do not Indicate $ value in Section D 


[T]Federal FI Local [H International 

H. Sentence Date:__ 

Sentence Type: • 

M. Acquittal/ Dismissal/ Pretrial Diversion 

Coda • j Amount S 

In M. Mnn.h, 

(Circle one) Date: 

Code •_v Amount S 

Suspended: Years_Months ___ 

N. Drug Seizures ✓ Date: 

□ Court Ordered [□Pretrial Diversion 

Code •_✓ Amount S 

Fines: $ 

Drun Code * 

FDIN 

Do not Indicate S In Section D 

PELP Date: 

Code • ./■ Amount $ 


E, Hostages(s) Released Date:_ 

Disruption Date: 

0. Child Victim Information 

Released by: [□jTerrarist^J Other 

foiesmAnttempnt Dai a*. 

Child located / identified Date: 

Number of Hostenes: . 

Completion of FD-515a Side 2 Mandatory 

| [Living F*|Deceased 


rinding block D (Recovery/PELP), blocks E, 1, L and N 



Race* Sex_ Djrte of Birth Social Security No. (if available) 

tJ W* ot/o-rfm?' rur-rc, ~ 


x Additional information may be added by attaching another form or a plai 
• See codes on reverse side. 

v Requires that an explanation be attached and loaded Into ISRAA for reci 


er Si m and PELP over $5 m, disruption, dlsma 
































Page 


05/03/12 20:06:07 


05/03/2012 


"* INDICTMENT *************** 
UNCLASSIFIED 


Does Accomplishment Involve 

Drugs.: N 

A Fugitive.: N 

Bankruptcy Fraud.: N 

Computer Fraud/Abuse.: N 

Corruption of Public Officials: N 
Money Laundering.: N 

Sub. Invest. Asst by Other FOs: 



Investigative Assistance or Technique Used 









FINAN ANALYST 


LAB FIELD SUP 


UCO • NAT BACK 


VICT-WITN COOR 


AIRCRAFT ASST 


PEN REGISTERS 


NCAVC/VI-CAP 


IO WANTED FLYR 


COMPUTER ASST 


PHOTO COVERG! 


CRIM/NS INTEL 


SARS 


CONSEN MONITR 


POLYGRAPH 


CRIS NEG-FED 


CART 


ELSUR/FISC 


SRCH WAR EXEC 


CRIS NEG-LOC 


ASSET FORF PRO 


ELSUR/111 


SHOW MONEY 


ERT ASST 


FORF SUPPORT P 


ENG FIELD SUP 


SOG ASST 


BUTTE OSC 


TFOS/CTD 


ENG TAPE EXAM 


SWAT TEAM 


SAV OSC 


CXS/CTD 


LEGATS ASST. 


TECH AG/EQUIP 


POC SC 


INFRAGARD/CYD 


EVIDNCE PURCH 


TEL TOLL RECS 


FT. MON-NRCSC 


OFC/CID 


1NF0RMANT/CU 


UCO-GROUP I 


FOR LANG ASST 


PPP 

_ 

LAB DIV EXAMS 


UCO-GROUP II 

_ 

NON FBI LAB EX 


FUSION CENTERS 


= Helped, Minimally 
= Helped, Substantially 
= Absolutely Essential 


Indictment is for Federal, Local, or International (F/L/I)...: F 


b6 

b7C 

b7E 


U. S. Code Violation(s) 


Form FO-515a Side 2: 
Subject's Role = 


Title Section Counts 


18 1201 1 

18 1202 1 

18 1029 1 


Subject's Criminal Activity : 

If Other, Specify. . . . : 

If NON-LCN Member or Associate CM/A5: 

Name of NON-LCN Criminal Group. . . : 

If La Cosa Nostra (LCN) Member or Asso (M/A): 
Name of LCN organized Crime Group (OCG) . . . 
Position in LCN OCG . 

Name of Union: 

Union Affiliation: 

If Other, Specify: 


Business Influenced/Affected: 

If Other, Specify.: 

Name of Company Subject Connected with: 

Elected/Appointed Public Official Position: 
If Other, Specify. : 


Level of Union. . . . : 

If Local, Give Number: 
Position in Union.: 

If Other, Specify: 


Accomplishment Narrative 


UNCLASSIFIED 


































(Rev. 05-01-2008) 


#• 

UNCLASSIFIED 

FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 05/04/2012 

To: Anchorage 

From: Anchorage 


Contact: SA 


Approved By: 
Drafted By: 


Case ID #: 306-AN-15642 

Title: Israel Keyes; 

Samantha Tessla Koenig - Victim; 

Et Al; 

Serial Killings-Violent Criminal Threat 

Synopsis: Report late filing of Accomplishment Report (FD-515). 

Details: A FD-515 containing information regarding the arrest of 
Israel Keyes was submitted after the expiration of the 30 day 
deadline for f iling accomplishment reports. This was due to OST 
I ( of Dallas' inability to enter this FD-515. She 

received a message from ISRAA that this case was an invalid file 
number for the Dallas Division. 



UNCLASSIFIED 


aok-AN-l 56,43; iVb 
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_ UNCLASSIFIED//LES 

Current step: Cwrent Responsible, Party; 

Supervisor Review |_ \ (AN) (FBI) 

FD-71 

08-05-2011 
Build Version 
2.0.9000.120 

ADMINISTRATION 


FEDERAL BUREAU OF INVESTIGATION 

COMPLAINT/ASSESSMENT FORM 


Classification: 

©Unclassified OSoRfidSatjaf 
Dissemination controls: 


□ Edit Classification Text 

UNCLASSIFIED/ / LES_' 


Restrict Document Permissions 


Restricting the document permissions means that only the users listed on this form as the Supervisor, the Investigator, or those added 
through the SIM or Disseminate To features will be able to open and read this K>71. Additional users may be granted access as 
appropriate by using the form's Disseminate to Others field, though they may not be notified automatically. 


Unrestricted 


RECEIVED BY 

Status: __ [Priority:_ 

[pending fpriority 

Name | | (AN)(FBI) 

Enter the last name, first name, and click the Search button. 
Email | fa fbi.sgov.gov 

Counterterrorism, Domestic Terrorism, Cyber Terrorism, and WMD 
Incident Types must be reported through Guardian, and not this form. 

Incident Type: 

[Criminal Activity 

Receipt Method: 

Telephone 


Received On: 

3/22/2012 

Last Updated: 

3/22/2012 


Originator Type:. 

Complainant 

joriginating Agency: 

F 

rlglnator Telephone: 

Responsible Office (Show Legats? O) 

Anchorage 

RA: 

Responsible Squad (ACS Designation): 

C-2 


Is_this Assessment a spinoff from a Type 3 - 6 Assessment, or an existing predicated investigation? 

Yes 

Assessment Type or Predicated Case ID Serial Number (Provide the Serial Number used 

Investigation as the basis for spinning the matter to a Type 1 

or 2 Assessment) _ 

Predicated Investigation 1 |7A-AN -15642 1 L ~l 


RESPONSIBLE INVESTIGATOR 

RESPONSIBLE SUPERVISOR 

Name | |(AN) (FBI) 

Name | fcAN) (FBI) 

Enter the last name, first name, and click the Search button. 

Enter the last name, first name, and click the search button. 

Email | fefbi.saov.qov 

Email | fg)fbi.sgov.gov 




SUMMARY 


Synopsis of Complaint: 

Caller saw Israel Keyes driving North on the Glenn Highway at about the Ft. Richardson exit on March 2 at 11:30am. 


_ SENSITIVE INVESTIGATIVE MATTER 

A "Sensitive Investigative Matter" (SIM) relates to investigative activities where the nature of the person or 
group being assessed should be brought to the attention of FBI Headquarters and other DOJ officials. CDC 
review and SAC approval is required for all SIMs. Use the checkbox below to signify that this assessment is a 
SIM. Once the box is checked, follow the prompts on the form to provide additional details regarding the SIM. 

□ Sensitive investigative Matter __ 

Details of the Complaint: 




b7E 
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Caller says she saw Israel Keyes driving North on the Glenn Highway at about the Ft. Richardson exit on March 2 at 11:30am. She 
photographed his vehicle because she is in sales and cold calls businesses so she photographs the advertising information on cars as she 
drives. Caller recalls passing Keyes Construction vehicle on her way to Bade Rive r and seeing dri ver, now recognizes him from photograph 

in newspaper as Israel Keyes. Caller is emailing picture of vehicle to IA | I will forward to I on receipt. b6 

b7C 


Oeeurrencefsl: 


Time: 


From: 

To: 

Duration: 

Duration Units; 

3/2/2012 

3/2/2012 


| Minutes 


COMPLAINANT 

Complaint Received By:_^ 



bate of Complaint: fn me of Complaint: 

13/22/2012 |ll:40:00 AM 




Telephone: 


Email Address: 


SUBJECT 


Last Name or Organization Name: 

KEYES 

First Name: 

ISRAEL 

Middle Initial: JSocial Security Number: 

Date of Birth: 

Place of Birth: 

Phone Type: Phone Number 

Gender: 

Male (M) 

Build: . ... 

Complexion: 

Hair Color: 

Eye Color: 

Feet: Inches: 

Heioht:! ! , j 

Weight: 

Age: 

Facial Hair: 

Accent: 

Race: 

Driver's License Number: 

© Yes 
• US Person O No 

O Unknown 



Description (dress, mannerisms, or statements made): 


Address: 


Other Names: 


Other Addresses: 
ScarfsVTattoofs): 
Scar/Tattoo Description: 


Associate£s2;^_^_ 

Weapon(s): _ 

Weapon Description: 


Vehiclefs): 


_ INVESTIGATIVE METHODS _ 

If an Investigator has been assigned to conduct an assessment, all investigative methods used during this 
assessment must be reported on the form. The Add Method button can be used to create additional Method 
sections as needed. The Method Explanation field should be used to describe the results of each individual 
method emptoyed. Once the assessment has been completed, the Findings section can be used to report overall 

results and recommendations to the Supervisor. __ _ __ 

Method Options: .......... .... _ _ __I 


] 10/3/2012 


b7E 
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* 






Selected Method: 


Method Explanation: 


FINDINGS 


Recommended Classification: Recommended Alpha: 



PI Disseminate to FIG 


I~1 Disseminate to Others 
Recommended Action: 


Date: 


Assessment Findings: 


Federal Violation: 


AUTHORIZED PURPOSE(S) AND OBJECTIVEfS) 


_ SUPERVISOR REVIEW 

Responsible Supervisor: 

| kflN) (FBI) _ 


REVIEWS 


Period Start Date: 

Days: 

Supervisor Decision: 


5/8/2012 




Period End Date: 

30 

No Assessment, Upload to 0 or Case File 


6/7/2012 





DAdd Comments 


Office (Show Legats? D): 

Classification: (Alpha: 

File #: 

Sub Fite #: 

Case ID: 

Uploaded: 

Serial: 

Anchorage 

7 b_I 

15642 


7A-AN-15642 

□ 



^Please Enter the Ca se File Number according to the format #-FO-##### or ## ##-Q-ASSESS-#. Ex. l-CE-12345, 1Z3A-SU-C1234S6, | 

|Case ID: [uploaded: [serial: I 

Author:_ 


ACS now requires two CPI Codes when opening a case. One must he chosen in the National Threat Priority CPI Code field, and one from 
the CPI Code Reid. Additional CPI Codes can be added if desired in the CPI Code field. 


National Threat Priority CPI Code 

adsfad 


CPI Codes: 

;..■ '_ ij 


b6 

b7C 


b7E 

b6 

b7C 


Case IP: _ 

7A-AN-15642 


1 Uploaded: 

1 □ 


I serlat: 


] 10/3/2012 


b7E 














P Federal Bureau of Investigation 
r Digital Evidence Laboratory 


Operational Technology 
ERF Building 27958A 
Quantico, Virginia 22135 


REPORT OF EXAMINATION 


To: 


Anchorage Date: May 8,2012 

Squad C-2 5>0{p _ 

Attention: SA l I Case ID No.^A-AN-l5642 HpR 



Lab No.: 120302257 QT 


Reference: Communication dated March 6,2012 


Ref. No.: Serial 20 


Title: UNSUB(S); 

SAMANTHA TESSLA KOENIG - VICTIM; 
KIDNAPPING 
ANCHORAGE, ALASKA 
02/01/2012 


Date specimen received: March 2, 2012 
March 9, 2012 


Specimens received March 2,2012: 

Q2 Down loaded digital image files, copied to CD and labeled as “Images 

down loaded from FO” (1B4, E5123006) 

Specimens received March 9,2012: 

Q3 One MEMOREX CD-R labeled in part “ATM 186 Denali Alaskan” (1B3, 
E5123002) 


Page 1 of3 


An ASCLDfLAB-Inlernaliona! 
Accredited Laboratory 
Since January 16,2007 



For Official Use Only 


soorAi'l-l5<4>4Q;l?7 : 






Request: 


saQ 


>f the Anchorage Field Office requested via telephonic 


communication on April 3,2012 and electronic communication dated April 6,2012 
that the Forensic Audio, Video and Image Analysis Unit enhance images of the 
questioned individual and determine the make, model and year of the questioned 
vehicles. 


Opinions and Conclusions: 

The questioned SUV type vehicle depicted in the Q2 and Q3 images shares class 
characteristics with a 2005-2012 NISSAN XTERRA. Due to insufficient image 
detail, no conclusion could be reached on the make, model and year of the questioned 
truck image. 


Summary of Examination: 


Selected images were electronically processed and saved. A comparison was 
conducted between the questioned SUV depicted in the Q2 and Q3 images and 
images of2005-2012 NISSAN XTERJRA. 


Details of Examination: 




The Q2 and Q3 submitted evidence was reviewed to locate image.s'tyljijpft bjftt depict 
the questioned vehicles and individual. Selected images were electronically 
processed and printed. 


A search was conducted using the Digital Automotive Image System (DAIS) and 
resources available to the public on the internet to locate vehicles whose class 
characteristics correspond to those of the questioned vehicles depicted in the Q2 and 
Q3 images. The SUV type questioned vehicle shares class characteristics with the 
2005-2012 NISSAN XTERRA. Due to insufficient image detail the make and model 
of the questioned truck depicted in the Q2 and Q3 images could not be determined. 


Processed images horn Q2 and Q3 were saved to a compact disc which was labeled 
as DEI. 


Disposition of Evidence: 


Processed images from Q2 were saved and electronically transferred to SA | | on 

April 2,2012. 


7A-AN-15642 
120302257 QT 
Page 2 of 3 

For Official Use Only 





The Q2 CD, Q3 CD and DEI CD produced during these examinations were 
forwarded to your office on May 8,2012 vi a Fed Ex. _ 


Examiner: 


Operational Technology Division 

Forensic Audio, Video and Image Analysis Unit 


7A-AN-15642 
120302257 QT 
Page 3 of3 


For Official Use Only 
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UNCLASSIFIED//LES 


Current Step: Current Responsible Party: 

Supervisor Review | | (AN) (FBI) 


FD-71 

08-05-2011 
Build Version 
2.0,9000.120 


FEDERAL BUREAU OF INVESTIGATION 

COMPLAINT/ASSESSMENT FORM 


ADMINISTRATION 


Classification: 

©Unclassified ^fewHentST^ 5 ” 51 ^ 
Dissemination controls: 

Dl'iui-ukNDuKLu i 'iD r jiuuD i' KOi m I 


□ Edit C lassificatio n Text 

: U N C LAS SI FI ED/ /LES _ 


Restrict Document Permissions 

Restricting the document permissions means that only the users listed on this form as the Supervisor, the Investigator, or those added 
through the SIM or Disseminate To features will be able to open and read this FD-71. Additional users may be granted access as 
appropriate by using the form's Disseminate to Others field, though they may not be notified automatically. 


Unrestricted 


RECEIVED BY 

[Status: 

(pending 

(priority: 

Name | IfANIfFBI) 

Routine 

Enter the last name, first name, and click the Search button. 

Email | |sfbi.sqov.qov 

Counterterrorism, Domestic Terrorism, Cyber Terrorism, and WMD 
incident Types must be reported through Guardian, and not this form. 

[incident Type: . 

I Criminal Activity 

Receipt Method: 

jTelephone 

iRecelved On: 

3/20/2012 

Last Updated: 

3/20/2012 


Originator Type: 

Complainant 

Joriginating Agency: 

r 

riglnator Telephone: 

Responsible Office (Show Legats? D) 

Anchorage I 

RA: 

Responsible Squad (ACS Designation): 


Is.this Assessment a spinoff from a Type 3 - 6 Assessment, or an 

Yes 

Assessment Type or Predicated Case ID 

Investigation 

Predicated Investigation jj7A-AN-1564 2 


existing predicated Investigation? 


Serial Number (Provide the Serial Number used 
as the basis for spinning the matter to a Type 1 
or 2 Assessment) 


3 


RESPONSIBLE INVESTIGATOR 

RESPONSIBLE SUPERVISOR 

Name | |(AN) (FBI) 

Name | |(AN) (FBI) 

Enter the last name, first name, and click the Search button. 
Email | [afbi.sgov.gov 

Enter the last name, first name, and dick the Search button. 

Email | [afbi.sgov.gov 

SUMt 

-1ARY 

Synopsis of Complaint: 

Caller encountered individual resembling KEYES in a deserted parking area at her business a few weeks prior to the KOENIG abduction. 


_ SENSITIVE INVESTIGATIVE MATTER _ 

A "Sensitive Investigative Matter" (SIM) relates to investigative activities where the nature of the person or 
group being assessed should be brought to the attention of FBI Headquarters and other DOJ officials. CDC 
review and SAC approval is required for all SIMs. Use the checkbox below to signify that this assessment is a 
SIM. Once the box is checked, foilow the prompts on the form to provide additional details regarding the SIM. 

□ Sensitive Investigative Matter _ __ 

Details of the Complaint: 




b7E 
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Caller advised that she works at Alaska Healing Arts Chiropractic at the comer of Laurel and East 42nd In the vicinity of the Tudor and Lake 
Otis intersection. Caller advised Healing Arts has an employee parking lot in the rear of the building that Is a cul-de-sac type lot, utilized 
only by employees. Caller advised that at approximately 5:45 p.m., one January evening shortly before the KOENIG abduction, she was the 
last employee to leave work. Caller left the building and was walking across the empty parking lot towards her car when a maroon Jeep 
Cherokee, license number beginning in "G", entered the parking lot, drove the length of the parking lot, backed up the entire way and 
parked directly next to her vehicle. Caller said the lone male occupant of the vehicle stared at her and watched her get into her vehicle. 
Caller said she found It odd at the time and reported to her coworkers that a strange man was lurking In their parking lot and to be careful 
when leaving after hours. Caller said, after seeing a picture of KEYES in the Anchorage Daily News, she believes he was the occupant of the 
Jeep. 


Occurrence (s'): 


Time: 


From: 

To: 

Duration: 

Duration Units: 

1/11/2012 

1/31/2012 

15 

Minutes 


COMPLAINANT 

Complaint Received By: 



[Date of Complaint: h me of Complaint: 

1_1_ 



(3/20/2012 |3:50:00 AM 


_ Gender: Date of Birth: 

□ Protect Identity Female (n \ \ 


^ Anchorage, AK 


FemaleJF)_ 

Telephone: 


Email Address: 


b6 

b7C 


SUBJECT 


Last Name or Organization Name: 

first Name: 

Middle Initial: |Social Security Number: 

Date of Birth: 

Place of Birth: 

Phone Type: Phone Number 

Gender: 

Build: 

Complexion: 

Male (M) 

Small 


Hair Color; 

Eye Color:.. . 

Feet: Inches: 

Height: L. f i > 

Weight: 

Age: 

Facial Hair:... 

Accent: 

Race: 

White (Including Hispanic) 

Driver's License Number: 

O Yes 

US Person O No 

© Unknown 



Description (dress, mannerisms, or statements made): 
White male, slight build, hair slicked back 




Other Names: 


Other Addresses: 
Scar(s)/Tattoo(s): 
Scar/Tattoo Description: 


Associate(s): 

Weapon(s): _ 

Weapon Description: 


VehicleCs): 


_ INVESTIGATIVE METHODS _ 

If an Investigator has been assigned to conduct an assessment, all investigative methods used during this 
assessment must be reported on the form. The Add Method button can be used to create additional Method 
sections as needed. The Method Explanation field should be used to describe the results of each individual 
method employed. Once the assessment has been completed, the Findings section can be used to report overall 


] 10/3/2012 


b7E 
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results and recommen datio ns to the Supervisor. 

Method Options: 


Selected Method: 


Method Explanation: 


_ FINDINGS 

Recommended Classification: Recommended Alpha: 


Q Disseminate to FIG 


l~l Disseminate to Others 


Recommended Action: 


Close Assessment, Upload to Case File j 


Date: 

Assessment Findings: 


Federal Violation: 


AUTHORIZED PURPOSE(S) AND OBJECTIVE(S) 


SUPERVISOR REVIEW 


IPeriod Start Date: pays] Isupervisor Decision: 


Start or Continue Assessment 


□ Add 


Period Start Date: 

Days: 

Supervisor Decision: 


S/14/2012 




Period End Date: 

30 

No Assessment, Upload to 0 or Case File : 


6/13/2012 





□ Add 


Comments 


Office (Show Uegats? □): 

Classification: 

Alpha: 

File #t 

Sub File #: 

Case ID: 

Uploaded: 

Serial: 

,Anchorage 

306 


15642 


306-AN-15642 

□ 



lease ID: 
Author: 


| Uploaded: |Serial: | 


National Threat Priority CPI Code CPI Codes: 

adsfad____ 


h>6 

b7C 

b7E 
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UNCLASSIFIED 


\ 

\ FEDERAL. BUREAU OF INVESTIGATION 


Precedence: PRIORITY 

To: Laboratory 


Date: 05/15/2012 

Attn: Trace Evidence Unit ; 


_Unit; 


From: Albany 

Vermont - 
Contact: 


Rutland RA 
SA I 


Approved By: 

Drafted By: 

/Case ID #: 306-AN-15642 (Pending) 

Title: SERIAL KILLING INVESTIGATION 

00: AN 


Synopsis: To request Laboratory examination(s). 


Administrative: Reference telcal between SA 

1 

Albany Division and Examiner| j 

of the Trace 

Evidence Unit on 05/15/2012. 


b6 

b7C 


Package Copy: Being forwarded under separate cover is evidence 
item 1B187, Barcode E4254807, described as "Hair mass" (Evidence 
Item #1 on the Evidence Recovery Log) 

Details: The Laboratory is requested to conduct hair and, if • 
applicable, DNA examinations, on evidence item IB 187, Barcode 
E4254807, described as "Hair mass" (Evidence Item #1 on the 
Evidence Recovery Log). 

Summary of case : In June 2011, William and Lorraine Currier went 
missing from their home in Essex, Vermont, under suspicious 
circumstances. In April 2012, the Anchorage Division was 
investigating a separate kidnaping/murder investigation. During 
an interview of Anchorage's subject, the subject confessed to 
murdering the Curriers. Information provided by the subject led 
investigators to an abandoned farmhouse in Essex, Vermont, where 
the subject claimed to have left the Curriers' bodies. 
Investigators determined that the abandoned farmhouse was torn 
down in October, 2011, and the contents of the farmhouse was 
tracked to the Coventry landfill, in Newport, Vermont. 


soa>-AN-lt>64-.Qj?q 


□ 


UNCLASSIFIED 







UNCLASSIFIED 


To: Laboratory From: Albany 
Re: . 306-AN-15642, 05/15/2012 


Since May 7, 2012, ERT team members from Albany, 

Boston, New York and Newark, along with members of the Vermont 
State Police and the Essex, Vermont Police Department, have been 
searching the Coventry Landfill for the remains of William and 
Lorraine Currier. The search is being conducted with consent of 
the landfill owner. New England Waste Services. 

On 05/11/2012, a mass of hair was found by the ERT 
searchers. The mass of hair (evidence item IB 187, Barcode 
E4254807) is being sent to the Trace Evidence Unit for hair 
examinations, specifically to determine if the hair is human. 

If the hair is human, it is requested that the 
Laboratory conduct appropriate DNA examinations to develop a DNA 
profile for comparison to known DNA profiles of Bill and Lorraine 
Currier. The Vermont State Laboratory (VSL) has a DNA profile 
for Lorraine Currier as well as a male DNA profile which is 
believed to be William Currier's. The male profile'was derived 
from a razor collected from th e Curriers residenc e. The Po int of 
Contact a t the VSL is Examiner [ I telephone I I 


***The identifying information for the Curriers is as 
follows: WILLIAM S. CURRIER, aka Bill Currier, white male, DOB 

04/04/1961, SSN 009-56-3741, FBI# 751667EA3, HGT: S'11”, lka 8 
Colbert Street, Essex, Vermont; LORRAINE CURRIER, white female, 
DOB 07/04/1955, SSN 008-42-5554, HGT: 5'4", lka 8 Colbert Street, 
Essex, Vermont. 


UNCLASSIFIED 





UNCLASSIFIED 


To: Laboratory From: Albany 

Re: 306-AN-15642, 05/15/2012 


LEAD(s) : 

Set Lead 1: (Action) 

LABORATORY 

AT QUANTICO, VA 

Conduct laboratory examinations: Determine if the Hair 
mass (evidence item IB 187, Barcode E4254807) is human. If 
human, conduct appropriate DNA examinations to develop a DNA 
profile for comparison to known DNA profiles of Bill and Lorraine 
Currier. The Vermont State Laboratory (VSL) has a DNA profile 
for Lorraine Currier as well as a male DNA profile which is 
believed to be William Currier’s. The male profile was derived 
from a razor collected from th e Curriers residence . The Po int of 
Contact at the VSL is Examiner I I telephone I I 


UNCLASSIFIED 
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Current Step: 

Supervisor Review 

FD-71 

Revised 
08-05-2011 
8ui!d Version 
2.Q.9000.120_ 


_ UNCLASSIFIED 

Current Responsible Party: 

| I (AN) (FBI) 


FEDERAL BUREAU OF INVESTIGATION 

COMPLAINT/ASSESSMENT FORM 

ADMINISTRATION_ 


Classification: 

©Unclassified ©CsBfWeSSif 
Dissemination controls: 

D NU FUkN D U KL.UN Ell F UUU D FRUF fN BLL.lD i tgL!DoDriOADrOlDnCLT < 


□ Edit Classification Text_ 

UNCLASSIFIED^" 


] 


b6 

b7C 


| 


Restrict Document Permissions 


Restricting the document permissions means that only the users listed on this form as the Supervisor, the Investigator, or those added 
through the SIM or Disseminate To features will be able to open and read this FD-71. Additional users may be granted access as 
appropriate by using the form's Disseminate to Others field, though they may not be notified automatically. 


Unrestricted 


RECEIVED BY 

[Status:. . 

[Priority: 

Name | 

_J(AN)(FBI) 

[Pending 

Routine 

Enter the last name, first 

name, and dick the Search button. 

[Counterterrorism, Domestic Terrorism, Cyber Terrorism, and WMD 
Incident Types must be reported through Guardian, and not this form. 

Email 1 |@)fbi. 

sgov.gov 

Incident Type: 

{Criminal Activity 

Receipt Method: 

Telephone 



Received On: 

3/8/2012 

Last Updated: 

3/8/2012 


Originator Type: . (originating Agency; [originator Telephone: 

Complainant I __ 


Responsible Office (Show Legate? D) 

RA: 

Responsible Serial (ACS Designation): 

Anchorage 


dz 


ls_this Assessment a spinoff from a Type 3 - 6 Assessment, or an existing predicated Investigation? 

No _ 


RESPONSIBLE INVESTIGATOR 

RESPONSIBLE SUPERVISOR 

Name Last Name, First Name 

Enter the last name, first name, and click the Search button.- 

Name 1 l(AN) (FBI) 

Enter the last name, first name, and dick the Search button. 

Email | fclifbi.sqov.qov 


SUMMARY 


Synopsis of Complaint: 

Complainant advised that an "employee" of Alaska Snow Removal was saying "weird" things about Samantha Koenig a day or two after her 
disappearance. 


_ SENSITIVE INVESTIGATIVE MATTER _ 

A "Sensitive Investigative Matter” (SIM) relates to investigative activities where the nature of the person or 
group being assessed should be brought to the attention of FBI Headquarters and other DOT officials. CDC 
review and SAC approval is required for alt SIMs. Use the checkbox below to signify that this assessment is a 
SIM. Once the box is checked, follow the prompts on the form to provide additional details regarding the SIM. 

O Sensitive investigative Matter 
Details of the Complaint: 

Complainant advised that he is a heavy equipment operator and as such, performs some work on an on-call basis for Alaska Snow Removal 
(ASR) located at 2134 E. 88th Avenue. C advised that ASR employs a large transient staff of contract laborers, plow drivers, and heavy 
equipment operators, such that most of the "employees" don't know each other. C was at the ASR shop preparing for work a day or two 
after the disappearance of Koenig. On this occasion, C was approached by another ASR “employee" (UM1, NFI) who said he overheard 
another ASR "employee" (UM2, possibly a laborer, NFI) saying weird things about Koenig. This ted C to believe that UM2 may have had 
some intimate knowledge of Koenig’s disappearance. C did not hear or did not recall hearing what UM1 heard UM2 say. C suggested law ■ 
enforcement attempt to determine who was employed at ASR a day or two after her disappearance. 







Occurrence(s): 


Time: 


From: 

To: 

Duration: 

Duration Units: 

i ! 


COMPLAINANT 

Complaint Received By: 

1 


|Date of Complaint: jrime of Complaint: 

Name: 

1 1 


□ Protect Identity 

Gender: Date of Birth: 

Male (M) ( 


Address: _ Telephone: 

I | AK (outside Anchorage) | 


Email Address: 


SUBJECT 


Last Name or Organization Name: 

First Name: 

Middle Initial: |Social Security Number: 

Date of Birth: 

Place of Birth: 

Phone Type: Phone Number 

Gender: 


Complexion: 




Hair Color: 

Eye Color: ..J 

Feet: Inches: 

Height:! .It .i 

Weight: 

Age: 

Facial Hair: 

Accent: 

Race: 

Driver's License Number: 

O Yes 

US Person 0 No 

© Unknown 



Description (dress, mannerisms, or statements made): 


b6 

b7C 


Address: 


Other Names: 


Other Addresses: 
Scar(s)/TattooCs): 
Scar/Tattoo Description: 


Associate(s): 

Weapon(s): _ 

Weapon Description: 


Vehlclefs); 


_ : _ INVESTIGATIVE METHODS _ 

If an Investigator has been assigned to conduct an assessment, all investigative methods used during this 
assessment must be reported on the form. The Add Method button can be used to create additional Method 
sections as needed. The Method Explanation field should be used to describe the results of each individual 
method employed. Once the assessment has been completed, the Findings section can be used to report overall 
results and recommendations to the Supervisor. 

Method Options: .. . .. ] 

Selected Method; 


Method Explanation: 


] 10/3/2012 


b7E 
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♦ 


_ FINDINGS 

Recommended Classification: Recommended Alpha: 


□ Disseminate to FIG 

□ Disseminate to Others 

Recommended Action: 

.vi 


Date: 



Assessment Findings: 


Federal Violation: 


AUTHORIZED PURPOSE(S) AND OBJECTIVE^) 


SUPERVISOR REVIEW 


Period Start Date: 

Days: 

Supervisor Decision: 


Period End Date: 


No Assessment, Upload to 0 or Case File 



□Add 


Office (Show Legats? □): 

Classification: 

Alpha: 

File #! 

Sub File #: 

Case ID: 

Uploaded: 

Serial: 

Anchorage __ 1 

7 

!*7j 

15642 


7A-AN-15642 

□ 



| Uploaded: |Serial: 


National Threat Priority CPI Code 

adsfad 


Case ID: _ 

7A-AN-15642 


I Uploaded? 


jserial: 


□ 


ATTACHMENTS 


Upload 
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O Description! 

□ | 


Attachment; 
j File Attachment 

UNCLASSIFIED 


Case ID: Serial Num: 


10/3/2012 


b7E 




UNCLASSIFIED 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 05/14/2012 

To: Operational Technology Attn: CEAU Embedded En gineering Prog 

From: Anchorage 

C “ 1 i-, 

Contact: SAj_1 

Approved By: 

Drafted By: 


Case ID #: 306-AN-15642 (Pending) 

268-HQ-1305912-EE 

Title: KEYES, ISRAEL; 

SAMANTHA TESSLA KOENIG-VICTIM; 

ET AL; 

SERIAL KILLINGS-V10.LENT CRIMINAL THREAT 

Synopsis: To request Advanced Data Recovery of telephones 

Enclosure(s): 1. Search warrant for Samsung SCH-R631 black 
cellular telephone. 

2. Search warrant for black LG cellular telephone. 

3. Search warrant for AT&T Pantech cellular telephone, 

model #P2000. 

Details: On 02/01/2012, the victim, Samantha Koenig, was abducted from her place 
of employment, Common Grounds coffee stand in Anchorage, Alaska. On 
03/13/2012, the subject, Israel Keyes was arrested in Lufkin, Texas. Keyes has been 
interviewed on multiple occasions and has admitted to killing Koenig and provided 
details about the abduction and homicide. In addition, Keyes has admitted to killing 
two other individuals in Vermont and eluded to his involvement in other homicides over 
the past fourteen years. 

The following items of evidence are being sent to Operational Technology 

for analysis: 

1B7 (bar code E5123674) Item 32A: Samsung SCH-R631, Black cellular 
phone, possible serial number A0000023DD5112 or 80015743, FCC ID#A3LSCJR631, 
victim’s phone. 


UNCLASSIFIED 


3o/p-AM-I'56>4<9;1&I 





UNCLASSIFIED 


To: Operational Technology From: Anchorage 
Re: 306-AN-15642, 05/14/2012 


1B20 (bar code E5123089) One LG cell phone with charger, serial 
number 104CYHE2202705, track phone. 

1B21 (bar code E5123090) AT&T Pantech P2000 flip cellular telephone, 
serial number 110301023456. 

Anchorage CART analyzed the three phones. The CART submission ID 
is 108174. 1B7 and 1B21 were analyzed using Cellebrite version 1.1.9.4. Phones 
provided photographs, contact lists and call logs. 1B20 was anal yzed with no 
success. The CART contact is SA | | Her contact is | | 

_If you have additional questions, please contact l l at 


UNCLASSIFIED 





UNCLASSIFIED 


To: Operational Technology From: Anchorage 
Re: 306-AN-15642, 05/14/2012 


LEAD(s): 

Set Lead 1: (Action) 

ANCHORAGE 

AT ANCHORAGE, ALASKA _ 

The Evidence Control Technician,| | is requested to ship out 

above telephones to Operational Technology, 

Set Lead 2: (Action) 

OPERATIONAL TECHNOLOGY 

AT FBIHQ, WASHINGTON D.C. 

Operational Technology Division is requested to perform an Advanced 
Data Recovery of the telephones listed in the Details section above. 

♦ ♦ 


UNCLASSIFIED 
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* 


UNCLASSIFIED 



FBI Laboratory 


2501 Investigation Parkway 
Quantico, Virginia 22135 


To: Anchorage Date: May 18, 2012 

Sq uad C-2 _ 

SA| I Case ID No.: 306-AN-15642 ™ 

1 - 1 b7C 

Lab No.: 120517005 PF 


Reference: Communication dated May 15,2012 
Your No.: 

Title: ISRAEL KEYES; 

SAMANTHA TESSLA KOENIG - VICTIM; 

ETAL; 

SERIAL KILLINGS - VIOLENT CRIMINAL THREAT 


Date specimens received: May 17, 2012 

The FBI Laboratory has received your request for examination. The accompanying 
items of evidence have been inventoried. The provided listing and description of the submitted 
items may be subject to change when the examination phase begins. If changes are made, they 
will be reflected in the Report of Examination issued by the examiner making the change. 

Specimens: 

Q4 Debris (IB 187, E4254807) 

Each examiner assigned to your request will issue a separate Report of Examination 
that will address the results of his/her expertise. Fo r technical questio ns, contact the following 
unit(s) assigned to your case: Trace Evidence Unit \ I 

If there is a change in the status of your investigation that would have an affect on the 
prioritization of your request, such as court deadlines, dismissal of charges, or gui lty pleas ; or if 
you have questions regarding the status of your case, contact Request Coordinator \~^ I 

i- u ~i 


UNCLASSIFIED 
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UNCLASSIFIED 



),§ FBI Laboratory 


2501 Investigation Parkway 
Quantico, Virginia 22135 


REPORT OF EXAMINATION 


To: Anchorage 

Date: May 8,2012 

C-l 


SA i ~1 

Case ID No.: 306-AN-15642 H?5 


Lab No.: 120501015 PF ACJ 


Reference: Communication dated April 27,2012 
Your No.: 

Title: ISRAEL KEYES; 

SAMANTHA TESSLA KOENIG - VICTIM; 

ETAL; 

SERIAL KILLINGS - VIOLENT CRIMINAL THREAT 

Date specimens received:' May 1, 2012 

The specimen listed below was examined in the Nuclear DNA Unit: 

K2 Smith & Wesson pistol. Serial Number PBA6901 (1B25, E5123094) 

This report contains the results of the serological analyses. 


b6 

b7C 


Results of Serological Examinations: 

Specimen K2 was examined for the presence of blood; however, none was 


detected. 1 


No other serological examinations were conducted. 
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UNCLASSIFIED 


OtKc-A ; I i —i 




UNCLASSIFIED 


? ' A 


Methods/Limitations: 

The following methods and limitations apply to the results/conclusions provided in the results 
section(s) of this report and are referenced by number in the body of the text for clarity. 

1. This conclusion is based on the result of the phenolphthalin test. Insufficient quality and/or 
quantity of biological material may affect the ability to detect blood. 


Remarks: 


The supporting records for the opinions and interpretations expressed in | 

this report are retained in the FBI files. The submitted items will be returned to you under i 

separate cover. For questions about the content of this report, please contact Forensic Examiner j 

| | For questions about the status of you r submission, includi ng b6 | 

anv remaining for ensic examinations, please contact Request Coordinator ! 1 b7c . 


Nuclear DNA Unit 


This report contains the opinions/interpretations of the examiner(s) who issued the report. 
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120501015 PFACJ 
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FD-302 (Rev. 10-6-95) 


- 1 - 

FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 05/17 /2012 

On April 16, 2012, SA l I met Essex 

Police Department Detective Corooral l I at 32 Upper Main 

Street, Essex, Vermont, the site of a search/excavation that had 
take n place on April 1 2-13, 20 12. Shortly before her arrival, Det. 
Cpl. l I advised SA [ I bv cell phone that a pair of 

eyeglasses had been found at 32 Upper Main Street earlier that 
morning by 1 [ of the excavation company Ormond 

Bushey and Sons, Inc. had been present at the address for follow-up 
work related to the excavation. 


When SA | . I arrived at the ad dress, Det. Col . | | 

advi sed her about his earlier meeting with I | told Det. 

Cpl. | | that he found the eyeg lasses on the ground and had 

picked them up. Det. Cpl. | I marked the location where the 

eyeglas ses were found with a sm all pie ce of metal pipe. Det. Cpl. 

I I took the eyeglasses from l | at 9:30 a.m. and secured the m 

in a plastic evidence bag. A person by the name of I 1 

was als o present w hen I I turned t he eyeglasses to Det. Cpl. 

| 1 Det. Cpl. | 1 had handled the eyeglasses with 

their bare hands. 



With SA | present, Det. Cpl. I I further marked 

the location where the eye glasses had been found with a wooden 
stake and yellow tape. SA l I took several photographs of the 

location with this marker in place. 

SA | [ and Det. Cpl I I triangulated the location 

of the eyeglasses. The eyeglasses were located 75’10" from the 
telephone pole on the western side of th.e driveway/entrance to the 
property (from Route 15) (of the two telephone poles at this 
location the one furthest-to the west was used as a marker) and 
69'5" from the northeast corner of the concrete top of a drain, 
which was 9* 11” from the aforementioned telephone pole. 

SA | I responded to 32 Upper M ain Street and 

accepted custody of the eyeglasses at 12:20 p.m. SA I I then 

transported the evidence to the Albany/Burlington, Vermont Resident 
Agency. 

At approximately 6:00 p.m. on the same date, SA | | 

returned to 32 Main Street to take additional photographs. The 


investigation on 4/16/2012 at Essex, Vermont _ 

File K 306-AN-15642 _ Date dictated 5/17/2012 

by SAl I _ 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. . . , t ^ . n , 

60(«-AM-l564?;lSb 
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Continuation of FD-302 of 


.On 4/16/2012 


additional photographs were taken to document the location of the 
eyeglasses in relation to the location of power sifter that was 
used during the search/excavation between April 12-13, 2012. The 
former location of the power sifter (it had since been r emoved) was 
evident by the impression it had left on the ground. SA | | re- 

marked the spot where the eyeglasses had been found with an orange 
flag. The former marker had been removed but the spot was 
identifiable by the impression left by the metal pipe which had 
been used originally to mark the location by Det. Cpl. | | 

On April 27, 2012, SA | ~~| while using gloves, 

repackaged the eyeglasses in a paper envelope. The original 
packaging was preserved with the eyeglasses within the paper 
envelope. 


Enclosed in the 1A Section of the file are the following: 

(1) Essex Police Department Evidence/Property/Receipt Log 
for the collection of the eyeglasses at 32 Upper Main 
Street, Essex, VT. 

(2) FD-597 documenting receipt of the evidence from Det. 

Cpl - 1 i 

(3) Notes and sketch of SA | | 

(4) CD containing photographs of the location of 
eyeglasses at 32 Upper Main Street. The CD contains a 
set photographs taken at approximately 11:30“ a.m. and a 
set of additional photographs taken at approximately 6 







(Rev. 05-5^-2008) 


UNCLASSIFIED 

FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE 

-^To: Anchorage 


From: Dallas 

Lufkin RA 
Contact: SA| 


Approved By 
Drafted By: 


ZOU 


Date: 05/14/2012 


SA |_ 

Squad C-2 


#: \A-AN-15642' V (Pending) 


O 


[13j |02. ec] 


Title: ISRAEL KEYES;- 

SAMANTHA TESSLA KOENIG - VICTIM; 
KIDNAPING 


b6 

b7C 



Synopsis: Forward evidence to Anchorage 

Package Copy: Being forwarded under separate cover is IB-17, a 
bag containing ammunition seized during the Dallas Division - 
Lufkin RA search of KEYES' rental vehicle. 

Details: On March 13, 2012, ISRAEL KEYES was arrested by writer 

and others after KEYES was developed as a suspect in the 
disappearance of SAMANTHA KOENIG and was determined to be 
responsible for using a stolen ‘bank debit card associate d with 
KOENIG's disappearance. On March 17, 2012, SA | |and _ 


OTHER Sealed Pursuant to Court Order 


UNCLASSIFIED 


a.o6>-AH-fe(p4d 







UNCLASSIFIED 


Anchorage From: Dallas 
7A-AN-15642, 05/14/2012 


OTHER Sealed Pursuant to Court Ordei 


UNCLASSIFIED 







UNCLASSIFIED 


To: Anchorage From: Dallas 
Re: 7A-AN-15642, 05/14/2012 


LEAD(s): 

Set Lead 1: (Action) 

ANCHORAGE 

AT ANCHORAGE, ALASKA 
Read and clear. 


♦♦ 


UNCLASSIFIED 
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UNCLASSIFIED 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 05/23/2012 

To: Seattle Attn: SA | I 

Poulsbo, RA 

From: Anchorage 

Squad 5 .__ 

Contact: SA l I 


Approved By: 

Drafted By: _ 

Case ID #: 306-AN-15642 (Pending) 

Title: ISRAEL KEYES 

SERIAL MURDER INVESTIGATION 


Synopsis: To set forth lead to the Seattle Division. 

Details: On 05/22/2012 the Anchorage Division interviewed KEYES in reference to 
ongoing criminal activity that he conducted through out the United States. 

As a result of this interview KEYES indicated the FBI should seize his 
boat that he utilized in 2005-2006 in Washington State. KEYES stated there could be 
DNA evidence to include blood inside the boat. KEYES also indicated that there may 
be blood evidence in or on the motor of the boat. 

Investigators believe KEYES utilized this boat to dispose of at least two 
bodies in Washington State area lakes. Further investigation to identify these bodies 
of water is ongoing at this time. 

The above interview was recorded both by video and audio in the 
Anchorage Division. During this interview KEYES gave verbal consent for the FBI to 
seize his boat 

The boat should be located at the residence oi l I who SA | 

has previously interviewed. 

The boat is described as a 15 to 16 foot Bayliner on a trailer with an 80 
horsepower outboard motor. The boat may also have a cover. 


306^H-l564<Q;Mc> 


UNCLASSIFIED 





UNCLASSIFIED 

To: Seattle From: Anchorage 
Re: 306-AN-15642, 05/23/2012 


LEAD(s): 

Set Lead 1: (Action) 

SEATTLE 

AT NEAH BAY. WASHINGTON 

Make contact with l l and determine if he has the above listed 

boat. If so take custody of boat and maintain for further investigation. 


♦ ♦ 


UNCLASSIFIED 
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UNCLASSIFIED 

FEDERAL BUREAU OF INVESTIGATION 


Precedence: PRIORITY 
To: Albany 

Laboratory 


Date: 05/23/2012 
Attn: SA[ 


Attn: SSA{I 


Evidence Response Team (ERT) Leader b7c 
(via email) 


ERT Unit {via email) 


From: Anchorage 

Squad C-2 
Contact: SA[ 


Approved By: 


Drafted By: | ] 

Case ID#: 306-AN-15642 (Pending) 

Title: ISRAEL KEYES; 

SAMANTHA TESSLA KOENIG - VICTIM, 

ETAL; 

SERIAL KILLINGS - VIOLENT CRIMINAL THREAT 


Synopsis: Set leads for logical investigation and evidence collection/recovery of a 
revolver stolen from the home of murder victims William and Lorraine Currier of Essex, 
Vermont, by subject Israel Keyes, in captioned matter. 


nistrative: Reference recent 

,_J (Anc horage Division). S/ 

Agent (SSA) | 


e cent Bureau te lcalls between Special Agent (SA) | ] 

>Al K Albany Division) and Supervisory Special 

^Laboratory Division). 


Details: Israel Keyes recently confessed to the armed kidnapping, carjacking, 
aggravated assault and murder of William and Lorraine Currier of Essex, Vermont, on 
06/08-09/2011. During these confessions, Keyes provided extremely accurate 
information, which led to the recovery of the murder weapon and associated items at 
the Blake Falls Reservoir in upstate New York. The boat launch near where these 
items were recovered is located just north of the bend where River Road becomes 
Raquette River Road, and the coordinates are approximately 44 degrees 28 , 07.17" 
north by 74 degrees 45'47.07'' west. The barrel and bolt of the murder weapon, which 
was a Ruger 10-22, were recovered by members of the FBI Underwater Search and 
Evidence Recovery Team (USERT) in shallow water approximately 50-70' due south 
from the southeast corner of the aforementioned boat launch. Other associated 
evidence was located nearby on land. 


SA l l and SSA I la re familiar with the aforementioned area 

and operations, and they participated in the site survey and/or evid ence recovery _ 

operation which occurred on or about 04/18/2012. In addition, S A I 

USERT Team Leader (TL), New York Division, conducted a survey and participated in 
this evidence recovery operation. 
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To: Albany From: Anchorage 
Re: 306-AN-15642, 05/23/2012 


Additional information provided by Keyes indicated that he disposed of the 
.38 caliber snub-nosed revolver that he stole from the Currier's home during their 
abduction, in the same area of the Blake Falls Reservoir that he tossed the barrel and 
bolt from the murder weapon. Keyes believed that the revolver should be within 
several feet of the location of the barrel and bolt. The revolver had a blued finish. 
Recipient(s) are referred to the audio recordings dated 04/12/2012 and 05/08/2012 on 

the Sharepoint site _ 

I I for additional 

details. 


Much of the known physical evidence that could tie Keyes to the Curriers 
was destroyed by Keyes or others, has been degraded by the elements, or has yet to 
be recovered. Therefore, the revolver he stole from their home and disposed of in the 
Blake Falls Reservoir in upstate New York is an important item of evidence, which could 
be used to corroborate Keyes’ confes sion an d substantially stren gthen this c ase. 
Consequently, it is requested that SA | [ coordinate with SSA f I to deploy 

appropriate elements of the USERT to conduct logical investigation and evidence 
collection/recovery of a revolver stolen from the home of murder victims William and 
Lorraine Currier of Essex, Vermont, by subject Israel Keyes, in captioned matter. 
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To: Albany From: Anchorage 
Re: 306-AN-15642, 05/23/2012 


UNCLASSIFIED 


Set Lead 1: (Action) 

ALBANY 

AT ALBANY. NY 

_ It is requested that S A) [ coordinate with SSA l ~1 

I K Laboratory Division) to deploy appropriate elements of the USERTto 

conduct logical investigation and evidence collection/recovery of a .38 caliber revolver 
stolen from the home of murder victims William and Lorraine Currier of Essex, Vermont, 
by subject Israel Keyes, in captioned matter. 


Set Lead 2: (Action) 

LABORATORY 

AT QUANTICO, VA 

It is requested that SSA l 1 coordinate with SA | 1 

I [ (Albany Division) to deploy appropriate elements of the USERT to conduct 
logical investigation and evidence collection/recovery of a .38 caliber revolver stolen 
from the home of murder victims William and Lorraine Currier of Essex, Vermont, by 
subject Israel Keyes, in captioned matter. 


♦ ♦ 


UNCLASSIFIED 
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Current Step: 

Supervisor Review 

Current Responsible Party: 

1 1 (AN) (FBI) 

b6 | 

FD-71 

Revised 
08-05-2011 
Buiid Version 
2.0.9000.120 


FEDERAL BUREAU OF INVESTIGATION 

COMPLAINT/ASSESSMENT FORM 

b7C 

ADMINISTRATION 


Classification: 

©Unclassified ©Sectgt^ 

Dissemination controls: 


□nuhUHnDuRLumDmuuDpRuvim BcaBTOPoBrowBrarBuH: re 

D Edit Classification Text 

uN classified' ~ Z. ~ . ." ". 

Restrict Document Permissions 

Restricting the document permissions means that only the users listed on this form as the Supervisor, the Investigator, or those added 
through the SIM or Disseminate To features will be able to open and read this FD-71. Additional users may be granted access as 
appropriate by using the form's Disseminate to Others field, though they may not be notified automatically. 

Unrestricted 


RECEIVED BY 

Status: ... _ ... 1 Priority: , ... 

Pending | Routine 

Name 1 |(AN... 

Enter the Sast name, first name, and click the Search button. 

Email | fefbi.sgov.gov 

Counterterrorism, Domestic Terrorism, Cyber Terrorism, and WMD 
Incident Types must be reported through Guardian, and not this form. 

Incident Type:.. 

[Criminal Activity 

Receipt Method: 

[Telephone 

Received On: 

3/16/2012 

Last Updated: 

3/16/2012 


Originator Type: . _ _ _ .[originating Agency: loriqinator Telephon^ 

Complainant _ J___ I I 


Responsible Office (Show Legats? D) 

RA: 

Responsible Squad (ACS Designation): 

.Anchorage i 




Is_thjs Assessment a spinoff from a Type 3-6 Assessment, or an existing predicated investigation? 

No _ 


RESPONSIBLE INVESTIGATOR 

RESPONSIBLE SUPERVISOR 

Name Last Name, First Name 

Enter the last name, first name, and click the Search button. 

Email 

Name | |{AN) (FBI) 

Enter the last name, first name, and dick the Search button. 

Email | gifbi.sgov.gov 


SUMMARY 


synopsis or complaint: . 

Complainant claims to have seen missing person, Samantha KOEING, along with | [ and an unidentified maie, on 02/08/2012 

at mile marker 122, Richardson Hwy. 


; _ SENSITIVE INVESTIGATIVE MATTER _ 

A "Sensitive Investigative Matter" (SIM) relates to investigative activities where the nature of the person or 
group being assessed should be brought to the attention of FBI Headquarters and other DOJ officials. CDC 
review and SAC approval is required for all SIMs. Use the checkbox below to signify that this assessment is a 
SIM. Once the box is checked, follow the prompts on the form to provide additional details regarding the SIM. 

PI Sensitive Investigative Matter_ 

Details of the Complaint: 


S0k-Ahl -| 


J 10/3/2012 >f b?E _ 
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Occurrence(s): 


Time: 



From: 

To: 

Duration: 

Duration Units: 


3/16/2012 

3/16/2012 

30 

^Minutes 

1 


COMPLAINANT 

Complaint Received By: 



bate of Complaint: 

flime of Complaint: 

Il2:01:00 PM 

1 



13/16/2012 



0 Protect Identity 

Gender: Date of Birth: 

L__1 


Male (M) j 


Address: 



Telephone: 



Email Address: 


SUBJECT 


jLast Name Organization Name: |Ftrst Name: 

Middle Initial: ISocial Security Number: 

pl b6 i 

Date of Birth: 

Place of Birth: 

Phone Type: Phone Number fa7C 

Cell | | 

Gender: 

Male (M) 

Build: 

Large 

lomplexion: 

HalrCo[or:_ __ 


Feet: Inches: 

Helaht:!® 7 ! 1 I 


Weight: 

180 

Age: 

facial Hair:.. 

Accent: 

Race: 

Driver's License Number: 

O Yes 

US Person O No 

© Unknown 



Description (dress, mannerisms, or statements made): 
Clean cut military style hair 


I lAnchorage, AK 

Other Names: 


Other Addresses: 
Scarfsl/Tattoofs): 
Scar/Tattoo Description: 


Associated): 


10/3/2012 








Associate Name: 


jAssociate Race: 

(Associate Information: 


Weapon(s): _ 

Weapon Description: 


Vehlcle(s): 

Type: 


(station Wagon (SW) 

Black (BLK) 

Make: 

Model; 

Subaru (SUBA) 



Additional Identifying Characteristics: 


_ INVESTIGATIVE METHODS _ 

If an Investigator has been assigned to conduct an assessment, all investigative methods used during this 
assessment must be reported on the form. The Add Method button can be used to create additional Method 
sections as needed. The Method Explanation field should be used to describe the results of each individual 
method employed. Once the assessment has been completed, the Findings section can be used to report overall 

results and recommendations to the Supervisor. _ 

Method Options: _ __ _ __ __ __~ ' | 

Selected Method: 


Method Explanation: 


_ FINDINGS 

Recommended Classification: Recommended Alpha: 

| . 

fl Disseminate to FIG 
□ Disseminate to Others 

Recommended Action:__ 


Date: 


Assessment Findings: 


Federal Violation: 


AUTHORIZED PURPOSE(S) AND QB3ECT1VE(S) 


_ SUPERVISOR REVIEW 

Responsible Supervisor: 

| (CAN) (FBI) _ 


REVIEWS 


Period Start Date: 

Days: 

Supervisor Decision: 


Period End Date: 


No Assessment, Upload to 0 or Case FileJ 
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FBI Laboratory 


REPORT OF EXAMINATION 


2501 Investigation Parkway 
Quantico, Virginia 22135 


To: Anchorage Date: May 18, 2012 

Squad C-2 

SA | 1 Case ID No.: 306-AN-15642 - 

Lab No.: 120517005 PF ABE 


Reference: Communication dated May 15,2012 
Your No.: 


Title: ISRAEL KEYES; 

SAMANTHA TESSLA KOENIG - VICTIM; 

ET AL; 

SERIAL KILLINGS - VIOLENT CRIMINAL THREAT 


b6 

b7C 


Date specimens received: May 17,2012 

The following specimen was examined in the Trace Evidence Unit (Hair and Fiber): 

Q4 Debris (IB 187, E4254807) 

The results of the trace evidence examinations (hair) are included in this report. 

Methods: 

Microscopic examination of hairs is accomplished by using stereomicroscopy and 
comparison microscopy. The presence or absence, appearance, arrangement and distribution of 
the characteristics within the cuticle, cortex, and medulla of the hairs are examined and may be 
compared during a hair examination. 


1 - R utland RA 

S4 
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UNCLASSIFIED 


Results of examinations: 

The specimen Q1 debris is comprised of human hairs. Two (2) hairs were found with 
roots which do not contain tissue. 

Per telephone call with SA l l no hairs are being submitted for 

mitochondrial DNA analysis at this time. 

No further trace evidence examinations were conducted at this time. 

The submitted specimen was examined visually using stereomicroscopy and 
comparison microscopy. 

Interpretation: 

Characteristics of hairs can be used to determine whether the hair is human or non¬ 
human, body area, racial characteristics, artificial treatment and whether a hair has been forcibly 
removed or naturally shed. The characteristics exhibited in the hair(s) are used as the 
comparison criteria. When the presence or absence, appearance, arrangement, and distribution 
of macroscopic and microscopic characteristics exhibited in a recovered hair(s) are the same as 
in a potential source, the possibility that the compared hair(s) originated from the same source 
cannot be excluded. Consequently, the source of the known sample can be included as a 
possible source of the recovered hair(s), although the association of hairs using macroscopic and 
microscopic characteristics does not constitute a basis for absolute personal identification. 

The inability to associate specimens through a microscopic hair/fiber examination 
does not preclude that the persons/items of interest had contact with each other. A number of 
factors can produce this result, including: 1) Hair/fiber evidence may not have transferred. 2) 
Hairs/fibers that did transfer may have been lost prior to submission to the laboratory. 3) The 
hairs/fibers transferred or the known comparison specimen submitted may not be representative 
of the source. 4) The hairs/fibers may be from a different source. 

Remarks: 


The supporting records for the opinions and interpretations expressed in this report 
are retained in the FBI files. 

For questions about the co ntent of this report, please contact Forensic Examiner 

For questions about the status of your s ubmission, including any remaining forensic 
examinations, please contact Request Coordinator ! | 

Page 2 of3 
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The specimens will be returned under separate cover upon completion of the 
laboratory examinations. 


Trace Evidence Unit 


This report contains the opinions/interpretations of the examiner(s) who issued the report. 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE * Date: 05/22/2012 

To: Anchorage Attn: SA l I 

Squad C-1 

From: CIRG 

NCAVC, BAU-2 __:__ 

Contact: SSA | | 


Approved By: 

Drafted By: _ 

Case ID #: 306-AN-15642 (Pending) 

Title: ISRAEL KEYES; 

SAMANTHA TESSLA KOENIG - VICTIM (DECEASED); 

ET AL; 

SERIAL KILLINGS 
Synopsis: Lead covered. 

Reference: 306-AN-15642 Serial 7 

Details: As outlined in the referenced Electronic Communication (EC), the National 
Center for the Analysis of Violent Crime (NCAVC) was asked to provide assistance with 
regard to the captioned victim's abduction. 

Since the time of the initial request, the offender has been identified and 
charged, the victim's body has been recovered, and the offender has been determined 
to be a serial killer. Current efforts are focused on identifying additional victims. 

The NCAVC has participated in a number of discussions related to 
investigative and interview strategies. The NCAVC will continue to assist the 
Anchorage Division as it proceeds with its serial killings investigation. 

In light of the above information, the NCAVC considers the lead set forth 
in,the referenced EC to be covered. 


3Qk-/W-| 
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To: Anchorage From: CIRG 
Re: 306-AN-15642, 05/22/2012 

LEAD(s): 

Set Lead 1: (Info) 

ANCHORAGE 

AT ANCHORAGE. AK 
Read and clear. 
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transcription 


your agency; 


-1 - 

FEDERAL BUREAU OF INVESTIGATION 

Date of 

Investigation on at 

File M Date dictated 

by 

This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to 
it and its contents are not to be distributed outside your agency. 


04/26/2012 


On 4/24/2012 an underwater search of a section of the Blake 
Falls Reservoir was conducted by the Underwater Search Evi dence Resp onse 
Team. The following USERT personnel participated: SSA |~ f 

I , I SAI I SAl | SA □ 

SA |__ I an d SAl_ I Evidence Response Team 

personnel SA l land SAl [participated . HMRU Physical 

Security Specialists ! l acte d as medics. 

Essex, Vermont Police Department Lt . I l and Cpl. | 

observed. The objects of the search were described as a barrel and 
bolt of a Ruger 10/22 target pistol. 

The dive side was assembled on a boat ramp at approximately 
the following GPS coordinates: 44 degrees 28 minutes 6.07 seconds north, 
74 degrees 45 minutes 47.26 seconds west. The site is a fresh water 
reservoir, and at the time of the dive operation water temperature was 
approximately 46 degrees Feranheight. Altitude was approximately 1264 
feet above sea level. 


b6 

b7C 


The search area itself was approximately fifty to seventy 
feet directly south of the boat ramp-. The shoreline was irregular due 
to a small stream flowing into the reservoir at the site. Parallel 
seventy five foot jackstays were utilized approximately eighty feet 
apart rigged to move together as the search progressed. The jackstays 
were set perpendicular to shore, approximately twenty feet from the 
shoreline, which, at the point of jackstay deployment, was somewhat 
further west as compared to the shoreline at the boat ramp, as the stream 
formed a small, shallow bay at the point it entered the reservoir. 

SA | l acted as dive supervisor. The XLDS surface 

supplied air system was utilized with underwater metal detectors. At 
approximately 9:15 am SA l I entered the water in a drysuit without 

SCUBA gear with a metal detector on a wand to search the s hallow bay 
area formed by the stream delta. At approximately 9:51 SA l I 

entered the water as red diver and was de ployed to the southernmost 
(far) jackstay. At approximately 9:53 SA | ~| entered the water as 
green diver and was deployed to the northernmost (near) jackstay. The 
bottom consisted of muck and mud with occasional large rocks protruding 
through bottom surface. 

At approximately 10:50 am SA l | located an object 

matching the description of the barrel in approximately four feet of 
water at the approximate GPS coordinates of 44 degrees 28.106 minutes 


4/24/2012 Parrishville, NY 


7A-AN-15642; 308A-NY-A252222 

Sfi l I 









FD-302ffi S> v rit&fi.9$ > y 74 degrees AS.Ill minutes south. At approximately 11:22 am 
SA | | located an object matching 1 the description of the bolt in 

approximately four fGPS coordinates 
transcription of 44 degrees 28.106 minutes north by 74 degre^S C 0 %5.775 west. Dive 
in&ifi&KSihions were terminated shortly thereafter. 

File# Date dictated 
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4/24/2012 Parrishville, NY 


7A-AN-15642; 308A-NY-A252222 
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FEDERAL BUREAU OF INVESTIGATION 

Precedence:ROUTINE Date: 05/31/2012 

To: Anchorage Attn: Evide nce Con trol Technician (ECT)[ 


From: Anchorage 

Squad C-2 
Contact: SA[ 


Approved By: | | 

Drafted By: | 1 

Case ID#: 306-AN-15642 (Pending) 

Title: ISRAEL KEYES; 

SAMANTHA TESSLA KOENIG - VICTIM; 

ETAL; 

SERIAL KILLINGS - VIOLENT CRIMINAL THREAT 

Synopsis: Late submission of evidence exhibits) for storage in captioned matter. 

Details: On 04/23/2012, bulky evidence item 1B183 in captioned matter was 
submitted to the Evidence Control Room (ECR), on what was believed to have been the 
tenth day after it was acquired. However, it was determined that the aforementioned 
item was actually submitted on the eleventh day after it was obtained (dates were 
correct, but day count was mistaken). Consequently, this communication memorializes 
the fact that the aforementioned item was inadvertently submitted after the expiration of 
the ten-day deadline for evidence submission, due to an oversight by the case agent(s). 
However, this bulky evidence was maintained in the case agents' presence or secure 
space within the Anchorage Division, until its entry into the Anchorage Division ECR. 


♦ ♦ 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: 
To: Albany 


/Anchorage 
Los Angeles 


New York 


From: Laboratory 

ORS / Evidenc e Response T eam Unit 
Con tact; SSAl _ 


Approved By: 
Drafted By: 


Case ID #: /o 6-AN-15642 (Pending) - !^ ? 

3 0 8A-HQ-A15092 5 6 (Pending) 

Title: ISRAEL KEYES; 

SAMANTHA TESSLA KOENIG - VICTIM, 

ET AL; 

SERIAL KILLINGS - VIOLENT CRIMINAL THREAT 

Synopsis: Authorization for New York USERT to conduct an 
underwater search near Potsdam, New York. 

Details: Israel Keyes recently confessed to the armed 

kidnapping, carjacking, aggravated assault and murder of William 
and Lorraine Currier of Essex, Vermont, on 06/08-09/2011. During 
these confessions, Keyes provided extremely accurate information, 
which led to the recovery of the murder weapon and associated 
items at the Blake Falls Reservoir in upstate New York. The boat 

UNCLASSIFIED 



Date: 05/24/2012 


SAC Clifford C, 

ASA Cl 

SS A| 


Holly 


Attn: SA 

Attn: ADIC Steven M. Martinez 

SAC Steven L. Gnmez__ 

ASAC | I 

SS Al r - 1 

SA I ZZJ 

Attn: ADIC Janice K. Fedarcyk 
SAC Mary E. Galliqan 
ASAC | 

SSAT 
SA 
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To: Anchorage From: Laboratory 
Re: 306-AN-15642, 05/24/2012 


launch near where these items were recovered is located just 
north of the bend where River Road becomes Raquette River Road, 
and the coordinates are approximately 44 degrees 28’07.17" north 
by 74 degrees 45'47.07" west. The barrel and bolt of the murder 
weapon, which was a Ruger 10-22, were recovered by members of the 
FBI Underwater Search and Evidence Recovery Team (USERT) in 
shallow water approximately 50-70’ due south from the southeast 
corner of the aforementioned boat launch. Other associated 
evidence was located nearby on land. 

SA | l and the writer are familiar with the 

aforementioned area and operations, and they participated in the 
site survey and/or evidence recovery operation which occ urred on 
or about 04/18/2012. In addition, SA I I USERT 

Team Leader (TL), .New York Division, conducted a survey and 
participated in this evidence recovery operation. 

Additional information provided by Keyes indicated that 
he disposed of the .38 caliber snub-nosed revolver that he stole 
from the Currier’s home during their abduction, in the same area 
of the Blake Falls Reservoir that he tossed the barrel and bolt 
from the murder weapon. Keyes believed that the revolver should 
be within several feet of the location of the barrel and bolt. 

The revolver had a blued finish. Recipient{s) are referred to 
the audio recordings dated 04/12/2012 and 05/08/2012 on the 
Sharenoint sihe_______^ 

| | tor additional details. 

Much of the known physical evidence that could tie 
Keyes to the Curriers was destroyed by Keyes or others, has been 
degraded by the elements, or has yet to be recovered. Therefore, 
the revolver he stole from their home and disposed of in the 
Blake Falls Reservoir in upstate New York is an important item of 
evidence, which could be used to corroborate Keyes' confession 
and substantially strengt hen this case. Consequently, it.is 
requested that SA | 1 coordinate with SSA | I to deploy 

appropriate elements of the USERT to conduct logical 
investigation and evidence collection/recovery of a revolver 
stolen from the home of murder victims William and Lorraine 
Currier of Essex, Vermont, by subject Israel Keyes, in captioned 
matter. 
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ERTU has approved the Albany Division's request. The 
previous site survey was satisfactorily completed on 04/18/2012. 
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To: Anchorage From: Laboratory 
Re; 306-AN-15642, 05/24/2012 
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To: Anchorage From: Laboratory- 
Re: 306-AN-15642 , 05/24/2012 

LEAD (s) s 

Set Lead 1: (Action) 

ALBANY 

AT POTSDAM. NEW YORK 

Provide support and assistance to the deployed USERT 

team. 

Set Lead 2: (Info) 

ANCHORAGE 

AT ANCHORAGE. ALASKA 
Read and Clear. 

Set Lead 3: (Action) 

LOS ANGELES 

AT LOS ANGELES, CALIFORNIA 

Provide USERT members to assist NY USERT in the 
underwater search. 

Set Lead 4: (Action) 

NEW YORK 

AT NEW YORK. NEW YORK 

Conduct an underwater search of the logical area and 
report results to the Albany and Anchorage Divisions and ERTU. 

♦0-2145a.wpd 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 05/29/2012 

To: Anchorage 

From: Anchorage __ 

Contact: |_| 


Approved By: 
Drafted By: 


Case ID #: 306-AN-15642 
Title: ISRAEL KEYES; 

SAMANTHA TESSLA KOENIG - VICTIM(DECEASED); 
ETAL; 

SERIAL KILLINGS 


Synopsis: Victim Property Return 


Enclosure(s): Mu nicipality of Ancho rage form number 51-013 with itemized list of 
property returned to | I 


Details : On 04/11/2012, Victim Specialist^ 


Hand Special Agent ! ~1 


| Ireturned prope rty held by Anchorage Police Department (APD) to identified 
victim ! ~j in captioned case. Copies of APD form 51-013 with itemized lists 

of property ret urneois enclosed with this EC. Original forms returned to Detective 
| [ at APD. 
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♦ ♦ 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 05/29/2012 

To: Anchorage 

From: Anchorage _ 

Contact: | | 

Approved By: [" ’ 

Drafted By: _ 

Case ID#: 306-AN-15642 


Title: ISRAEL KEYES; 

SAMANTHA TESSLA KOENIG - VICTIM (DECEASED); 
ETAL; 

SERIAL KILLINGS 


Synopsis: Victim Property Return 


Enclosure(s): Mu nicipality of Anchorag e form number 51-013 with itemized list of 
property returned to ! 7 


On 04/11/2012, Victim Specialist 


Hand Special Agent | | 


Ireturned property held by Anchorage Police Department (APD) to identified - 
victim I ~l in captioned case. Copy of APD form 51-013 with itemized 

list of property returned is enclosed with this EC. Original forms returned to Detective 
| f at APD. 


♦ ♦ 
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U.S. Department of Justice 


Federal Bureau of Investigation 


In Repiy, Please Refer to 

File No. 3 06-AN-15642 


101 East 6th Avenue 
Anchorage, AK 99501 
June 5, 2012 


National Personnel Records Center 
NARA 

Military Personnel Records 
1 Archives Drive 
St.Louis,Missouri 63138 
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RE: Israel Keyes, 


Dear Sir: 


In connection with an official investigation being 
conducted by the Anchorage Office of the Federal Bureau of 
Investigation (FBI), your office is requested to furnish 
certified copies of any and all military records,including all 
form DD-214s; records of dates of service and places of service; 
.records of training; records of any and all awards and 
commendations;psychiatric information and, all derogatory- 
information to include court martials or non-judicial 
punishments, pertaining to the following individuals: 



aofr-AM-lsM -Q ;^&(D 








Mary Frances Rook 
Special Agent in Charge 








' T 

(Rev. 05-01-2008) 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: DEADLINE 06/15/2012 

To: St. Louis Attn: 


Date: 06/5/2012 

Federal Record Center, 
Military Branch 


From: Anchorage 

C-2/Viole nt Crime Squad _ 

Contact: 1 I 


Approved By: 


Drafted By: 


Rppk Mary Frang^sf/ 


Case ID #: 306-AN-15642 



Title: Military Records Request 

Synopsis: Set lead to obtain individuals 1 military records 
Enclosure(s): Military Records Letter 


Details: The Violent Crime Squad of the Anchorage Division is 

requesting certified copies of any and all military records, 
including all form DD-214s; records of dates of service and 
places-of service; records of training; records of any and all 
awards and commendations; psychiatric information; and, all 
derogatory information to include court martials or non-judicial 
punishments pertaining to the following individuals: 


“DSBl-01X07/1978 

SSN: 127\86-4049. 

Branch of Service: Army 
Approx, dates of service: 


07/1998-07/2001 



UNCLASSIFIED 
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St. Louis From: Anchorage 
306-AN-15642, 06/5/2012 
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To: St. Louis From: Anchorage 

Re: 306-AN-15642, 06/5/2012 


LEAD (s) ; 

Set Lead 1: (Action) 

ST. LOUIS 

AT MILITARY PERSONNEL RECORDS 

St. Louis is requested to provide certified copies of 
any and all military records, including all form DD-214s; records 
of dates of service and places of service; records of training; 
records of any and all awards and commendations; psychiatric 
information; and, all derogatory information to include court 
martials or non-judicial punishments; pertaining to Israel Keyes, 

b6 
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Please send by FEDEX to: 101 East 6th Ave Anchorage,AK 99501 


♦♦ 


UNCLASSIFIED 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 04 /26/2012 


On April 24, 2012 , writer researched residential fires in 
Aledo, Texas. Writer identified two fires^nat occurred on 
February 16 , 2012 , on the 200 block of Te .grace Court', Aledo, Texa s. 
Writer located two newspaper articles describing the fires that 
destroyed an unoccupied house and a bar£, on the Weatherford 
Democrat newspaper website, www.weatherforddemocrat.com . The 
following articles were printed and placed in a 1A envelope: 

"Arson Suspected in Annetta South Fire" dated February 17, 2012 and 
" Annetta South Fire May Be Arson" dated February 20, 2012. 
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FEDERAL BUREAU OF INVESTIGATION 

Date of 

Investigation on at 

File § Date dictated 

by 

This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to 
it and its contents are not to be distributed outside your agency. 


06/11/2012 


On 6/05/2012 an underwater search of a section of the Blake 
Falls Reservoir was conducted by the Underwater Search Ev idence Resp onse 
Team. The f ollowing USERT pe rsonnel particip at ed: SA I 1 

~| SA I I SAl I SA | | SA 

| and SA | | Evidence Response Te am member | 

I participated. HMRU Physical Security Specialist ! 
acted as a medic. Essex, Vermont Police Department Lt. I 
observed. The object of the search was described as small Ruger 
revolver. 


b6 
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The dive side was assembled on a boat ramp at approximately 
the following GPS coordinates: 44 degrees 28 minutes 6.07 seconds north, 
74 degrees 45 minutes 47.26 seconds west. The site is a fresh water 
reservoir, and at the time of the dive operation water temperature was 
approximately 50 degrees Feranheight. Altitude was approximately 1264 
feet above sea level. 

The search area itself was approximately fifty to seventy 
feet directly south of the boat ramp. The shoreline was irregular due 
to a small stream flowing into the reservoir at the site. Parallel 
seventy five foot jackstays were utilized approximately eighty feet 
apart rigged to move together as the search progressed. The jackstays 
were set perpendicular to shore, approximately twenty feet from the 
shoreline, which, at the point of jackstay deployment, was somewhat 
further west as compared to the shoreline at the boat ramp, as the stream 
formed a small, shallow bay at the point it entered the reservoir. 

SA I I initially acted as dive supervisor. The XLDS 

surface supplied air system was util ized wi th underwater metal 
detectors. At approximately 9:49 SA | ~| entered the water as red 
diver and was deploye d to the so uthernmost (far) jackstay. At 
approximately 9:50 SA l I entered the water as green diver and 

was deployed to the northernmost (near.) jackstay. The bottom consisted 
of muck and mud with occasional large rocks protruding through the bottom 
surface. 

At approximately 10:35 am SA l I located an object 

matching the description of the search object in approximately four 
feet of water at the approximate GPS coordinates of 44 degrees 28.109 
minutes north by 74 degrees 45.779 minutes south. 


6/05/2012 Parrishville, NY 


7A-AN-15642; 308A-NY-A252222 

Sfl i i 









fd- 302(Rev. 10-6-95) The weapon was made safe by the writer by opening the cylinder 
and placing a zip-tie through the ba rrel'. It was packed in water from 
the reservoir and tu r n UPSvilr B i { £ E 4M I "f STIGATION 
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Investigation on at 
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This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to 

your agency; 

it and its contents are not to be distributed outside your agency. 
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File# 


- 1 - 

FEDERAL BUREAU OF INVESTIGATION 
Date of 

Date dictated 


by 

This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to 


youragency; 

it and its contents are not to be distributed outside your agency. 


05/24/2012 


On Wednesday, May 23, 2012, at approximately 10:38 AM, the 
following investigation was conducted on the Makah Indian Reservation 
located in Neah Bay, Washington: 


Pursuant to verbal consent to seize, provided by ISRAEL KEYES 
on May 22, 2012 during a video and audio recorded interview with 
Anchorage Division Agents, a 1992 Bayliner series POGPR15 boat [Vessel 
Registration Number WN7470GB] and trailer [Washington trailer license 
plate num be r 3408-MU1 wa s r eleased to SAsI I 

J |by I lof | | Neah Bay, Washington. ' 

According to l I the boat had been sitting idle in his y ard since 

KEYES moved to Alaska approximately five years prior. I 1 confirmed 
that the boat and trailer belonged to KEYES and that he had been looking 
after it since KEYES's departure to Alaska. 

Upon arrival at the residence located at I I 

Neah Bay, Washington, Agents observed the previously described boat 
and trailer parked in the front yard of the reside nce. T he boat was 
covered with a worn and soiled canvass boat cover. I I pointed out 

that the upper unit of the outboard engine had been d is-assembled with 
many of the parts contained within the boat. I I removed the drain 

plug from the back transom area, releasing a large amount of water from 
inside of the boat. The drain plug remained out of the transom for 
the duration of the trip to Seattle, Washington. 

Agents found that the right side trailer tire was intact but 
low on air, while the left side trailer tire was flat. 

With the assistance of I I Agents pulled the boat and 

trailer off the lawn and replaced the left side trailer tire with a 
spare tire which was located and mounted near the tra iler hitch. The 
old tire was re-mounted onto the trailer by SA | ~1 after it had been 
removed from the trailer axle. 

After the boat was hooked up to SA l I official Bureau 

vehicle, two digi tal photographs were taken of the boat and trailer 
using SA l I Blackberry cellular phone. One of these digital 

photographs was emailed to IA | | Anchorage Division, at 

10:56 AM (Pacific Time). These digital images were later burned to 
a CD-R and placed into a 1A envelope in the case file along with a copy 
of the printed email message. 
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May 23, 2012 Neah Bay, Washington 
306-AN-15642 
SAs | 


n/a 
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While trying to hook up-the'trailer lights for transport of 
• the boat to Seattle, for the trailer's 

transcription light s was foun d to be no n-compa tible with the fe8?t2 f e connector located 
infefoeaS& J l vehicle. at I 1 located and provided an adapter for 

Fiftfents to borrow. H owever, w hen the adapteiPawi^e&sed to connect the 
trailer .liqhts to SA I I vehicle, the trailer, lights failed to 

This oocument contains rail fer recommendation ! nui uiuuuaiuiiJ oftheKBl. It is meproperty/jflRbTBl and is loanelro ... - , . 

youragency; operate. To determine if it was a wiring issue or a lightbulb issue, 

’ i i U saffiiSovted(fefoanehQi&faegbiii4enfcrai 1 er light bulb and found that it appeared 

intact with no obvious signs of defect or damage. The lightbulb was 
placed back into the trailer's light housing as originally found. 


Agents then followed I l and another Tribal employee to 

two separate tribal facilities in search of air compressor with which 
to further fill the two trailer tires. At the Tribe's Vehicle 
Maintenance Facility, an air compressor was located. After inflating 
both tires on the trailer and the flat tire which had been removed from 
the left side, Agents departed for the FBI’s Evidence Response Team 
(ERT) facility located in Seattle, Washington. 


Due to the deteriorating condition of the boat cover, Agents 
stopped in Clallam Bay, Washington to insp ect the condition of the boat 
and the items located within. SA | ~| observed that the boat cover 
had torn in at least two places and was no longer providing anv pr otection 
from the rain and risked being completely torn off. SA | ~| gathered 
up the torn boat cover and using a water ski tow line, which had been 
hooked to the outside of the trans om area , secured the cover for the 
remaining portion of the trip. SA [ ~| a lso relocated a number of 
engine components which had been sitting freely on the transom area, 
to a lower portion of the boat where they would be more secure. 


The boat and trailer was transported to the ERT Facility 
without further incident. The boat and motor were secured within the 
facility at 5:10 PM. 


May 23, 2012 Neah Bay, Washington 


306-AN-15642 


n/a 
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FEDERAL BUREAU OF INVESTIGATION 

Date of 

Investigation on at 

File # Date dictated 

by 

This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to 


it and its contents at 


to be distributed outside your agency. 


05/24/2012 


On Wednesday, M ay 23, 2012 , I I DOB I I 

cellular telephone number | | Neah Bay Public Works Manager, 

was interviewed at the Neah Bay Tribal Center Administration Building. 

After being advised of the ident ity of the interviewing agents and 
the nature of the interview, [ I provided the following information: 

SA | | showed I I a copy of the Washington State 

Department of Licensing Vessel Title Application/Registration 
Certificate for a 1992 Bayliner POGPR15 series boat, Hull Identification 
Number (HIM) PL3B11CR10823, registered to ISRAEL KEYES, and aske d I 

if he was familiar with this particular boat. I I stated that he 

was an d tha t it wa s located in the front yard of his r esidenc e. SA 
| | asked |~ | who the legal owner of the boat was. I I stated 

tha t it be longed to KEYE S but was being stored at I I residence. 

SA | ~| advised | "{ that Agents had been requested to secure the 
vessel and tr ansport it back to Seattle, Washington for further 
examination. | | complied and never asked about the boat's 

significance to the KEYES investigation. 

I I further stated that KEYES purchased his boat in Sequim, 

Washington from an unknown person. K EYES us ed the boat for 
approximately two years before asking I l if he could store it at 

his residence when he moved to Alaska. The motor on the boat was "shot" 
and the boat ha d not been used or moved since KEYES initially backed 
it in to I ~1 yard. Two years ago, when KEYES was visiting, he gave 
| a hard time because he had not gotten the boat in working order. 


KEYES used the boat for recreation. | | and KEYES went 

tubing and s kiing together with it on Lake Ozette, WA. KEYES used a 
smaller boat | I has photos of 

himself and KEYES in the boat on Lake Ozette. 

I | brought the interviewing agents to his residence 

located at I I Neah Bay, WA, and assisted with hooking 

up KEYES' boat and trailer for towing back to the FBI' s Ev idence Response 
Team (ERT) facility, located in Seattle, Washington. | | signed, 

and was provided a copy of, an FD-597 Receipt for Property. The FD-597 
was placed into an FD-340 envelope to the file. 


5/23/2012 Neah Bay, Washington 

360-AN-15642 . n/a 

SAs [ 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 05/24/2012 

To: Anchorage Attn: [ | Squad 5 

From: Seattle 

Poulsbo RA_ 

Contact: | | 

Approved By: 

Drafted By: _ 

Case ID #: 306-AN-15642 (Pending) 

Title: ISRAEL KEYES; 

SERIAL MURDER INVESTIGATION 

Synopsis: Response to lead set by Anchorage to locate and seize Keyes’ Bay liner 
boat in Neah Bay, Washington. 

Reference: 306-AN-15642 Serial 190 

Enclosure(s): 


b6 

b7C 


1) One original and o ne copy of the FD-302 documenting the 

05/23/2012 interview of f I 

2) One original and one copy of the FD-302 documenting the seizure of 
Keyes' Bayliner boat. 

3) One FD-340,1-A envelope containing the FD-597 documenting 
the receipt of Keyes' Bayliner boat 


Details: On 5/23 /2012. pursuant to a lead set by Anchorage, SAs I I 

| l located l l in Neah Bay, W ashingto n and interviewed him 

about the whereabouts of Israel Keyes' Bayliner boat. I I maintained posses sion of 
Keyes’ boat since Keyes stored it at his house prior to moving to Alaska. I I turned 
over possession of the boat which was towed to Seattle for storage and further 
processing. 


Seattle considers this lead covered. 


UNCLASSIFIED 
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UNCLASSIFIED 

To: Anchorage From: Seattle 
Re: 306-AN-15642, 05/24/2012 


LEAD(s): 

Set Lead 1: (Info) 

ANCHORAGE 

AT ANCHORAGE, ALASKA 
Read and clear. 


♦ ♦ 


14d bl.EC 
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unclassified 

FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 06/14/2012 

To: Anchorage Attn: | | 

ELSUR Technician 

From: Anchorage 

C_1 I-1 

Contact: T 

Approved By: 

Drafted By: 


Case ID #: 306-AN-15642 (Pending) ~&D% 

Title: ISRAEL KEYES; 

SAMATHA TESSLA KOENIG-VICTIM; 

ET AL; 

SERIAL KILLINGS-VIOLENT CRIMINAL THREAT 

Synopsis: Submission of ELSUR evidence after ten day deadline. 

Details: On 6/11/2012, writer burnt a DVD off of the Plextor PX- 

800A Time Lapse DVD Recorder of the ISRAEL KEYES interview 

conducted on 6/1/2012 at the FBI Anchorage office. Writer _ 

misunderstood when custody of ELSUR evidence began. I I 

explained the custody of ELSUR evidence policy to writer. 
Subsequently, the DVD was not submitted for evidence prior to the 
ten day requirement. 



♦♦ 


UNCLASSIFIED 
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UNCLASSIFIED 

FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE 


Date: 06/15/2012 


To: Dallas 


Attn: SSAj 

SA I 


b6 ! 
b7C ' 


From: Anchorage 

C " 2 I-1 

Contact: TFO I 1 


Approved By: 

Drafted By: 

Case ID #: *^06-AN-15642 

Title: ISRAEL KEYES; 

SAMANTHA TESSLA KOENIG - VICTIM; 

ET AL; 

SERIAL KILLINGS - VIOLENT CRIMINAL THREAT 

Synopsis: To request the assistance of the Dallas Division / 

Lufkin RA in follow up investigation of Texas Missing Persons and. 
Arson in Aledo, Tx. 

Details: On February 2, 2012 Samantha Koenig was kidnaped from 

her place of employment by Israel Keyes. Keyes confessed to the 
kidnaping and murder of Koenig and has since been charged 
federally with kidnaping which resulted in the death of Koenig. 
Koenig's remains were recovered in Matanuska Lake, Ak. On March 
13, 2012 Israel Keyes was arrestecl^in Lufkin, Tx after using an 
ATM card associated with Samantha Keenig, Since being transported 
back to Anchorage Keyes has been ing with law 

enforcement, providing additional information about other crimes 
including kidnaping and murder. Kdy£S Confessed to the kidnap and 
murder of William and Lorraine Currijsr i.A Essex, VT on June 
8,2011. Currently the FBI and Essex, VT authorities are 
conducting a search of a landfill in Coventry, NY where the 
Currier bodies are believed to be. Israel Keyes confessed to an 
Arson in Aledo, TX and a bank robbery in Azle, TX both occurred 
on February 16, 2012. Keyes has told Law Enforcement that he is 
responsible for other victims in several states. Law enforcement 
believes it's possible that Keyes may be responsible for 
additional crimes in Texas, potentially a missing person. Law 
Enforcement has followed Keyes' travel in Texas through his cell 

UNCLASSIFIED 
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UNCLASSIFIED 


To: Dallas From: Anchorage 

Re: 306-AN-15642, 06/15/2012 


phone records as well as his credit card purchase's. There are at 
least three reported missing persons in Texas duri ng the time 
frame Keves was visitinq. Law Enforcement believes | j 

□ most fits Keyes' M.O. 

If you have any other questions please contact TFO | | 


UNCLASSIFIED 








UNCLASSIFIED 


# 


To: Dallas From: Anchorage 

Re: 306-AN-15642, 06/15/2012 


LEAD(s) : 

Set Lead 1: (Action) 

DALLAS 

AT AT LUFKIN, TX 

_ To investigat e the veracity of the Missing Person case of, 

l of Mount Enterprise, TX and the details b6 

surrounding the Arson in Aledo, Tx. b7c 


UNCLASSIFIED 
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UNCLASSIFIED 

FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE 


Date: 06/14/2012 


To : Anchorage 


Attn: SS?.~ 

SA 
SA 
TFC 


b6 

b7C 


From: Anchorage 

Squad C-2 

Contact: [ 


Approved By: 
Drafted By: 


Case ID #: 306-AN-15642 (Pending) 

Title: KEYES, ISRAEL KOENIG 

KOENIG, SAMANTHA, TESSLA ET AL 


Synopsis: To report results from requested Violent Criminal 

Apprehension Program (ViCAP) Assistance to query missing persons 
from April 7, 2009 - April 14, 2009 


Enclosure(s).: ViCap information request results 

Detai ls: On May 22, 2012, Staff Op erations Special ist I I 

I coordinated with Crime Analyst | ,~l ° f viCAP ' to 

disseminate an information request from ViCAP. The information 
request was sent to the following states: Connecticut, Delaware, 
Maine, Massachusetts, New Hampshire, New York, Ohio, 

Pennsylvania, and Vermont. It asked these states to provide 
information on missing persons last seen between April 7, 2009 to 
April 14, 2009. 

The request was product of information received during 
an interview with subject Israel KEYES. KEYES provided 
information that he killed someone during a trip to the 
northeastern part of the United States during April 7, 2009 - 
April 14, 2009. The remains of the individual are in New York, 
however, the individual is not from New York. No further 
information on the identify of the missing person was given. 
Attached are the results of the ViCap query. 


♦♦ 


| | 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE 

To: Anchorage 


Date: 06/14/2012 


Attn: SSi 

SA 
SA 
TFC 
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From: Anchorage 

Squad C-2 
Contact: [ 


Approved By: 

Drafted By: _ 

Case ID #: 306-AN-15642 (Pending )-—^Ljl 

Title: KEYES, ISRAEL KOENIG 

KOENIG, SAMANTHA, TESSLA ET AL 

Synopsis: To report results of Violent Criminal Apprehension 

Program (ViCAP rental car query for Israel KEYES 

Detai ls: On May 18, 2012, Staff Operations Specialist Katherine 

I provided Crime Analyst I 1 of ViCA P, with rental 

cars associated with KEYES.Crime Analyst l | queried the 

vehicle tags in the license plate reader database, but yielded 
negative results. The tag numbers below were queried. 



Date Rented 

Date Returned 

Company 

License Plate # Car Make/Model 

12/4/2007 

12/4/2007 


WA/303DKF 

2008 

Chrysler 





Sebring 





Convertible 

12/15/2007 

12/16/2007 


WA/168XUN 

2007 

Dodge Caliber 

1/28/2008 

2/6/2008 

Thrifty 

AL/95B9427 

2008 

Hyundai Sonata 

2/6/2008 

2/15/2008 

Thrifty 

WA/257DBF 

2007 

Ford Focus 

9/16/2008 

9/19/2008 

Thrifty 

CA/6DCF409 

2008 

Kia Optima 

10/31/2008 

11/5/2008 

Thrifty 

WA/443XQQ 

2008 

PT Cruiser 

4/2/2009 

4/7/2009 

Thrifty 

WA/877YUG 

2009 

Dodge Charger 

4/7/2009 

4/14/2009 

Thrifty 

NH/X74QFZ 

2007 

Hyundai Sonata 

7/7/2010 

7/9/2010 

Thrifty 

WA/6JCZ721 

2010 

Chevy Malibu 

2/2/2012 

2/17/2012 

Thrifty 

TX/CN8M857 

2011 

Kia 


♦♦ 
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UNCLASSIFIED 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE. Date: 06/19/2012 

To: Laboratory Attn: Trace Evidence Unit 

Forensic Anthropology Program 


From : Albany 

Squad 7/Bing hamton RA 

Contact:_ SAj_ 

Approved By: 

Drafted By: 


Case ID #: 306-AN-15642 (Pending) 

Title: ISRAEL KEYES; 

SAMANTHA TESSLA KOENIG - VICTIM; 

ET AL; 

SERIAL KILLINGS - VIOLENT CRIMINAL THREAT 



Synopsis : Request for FBI Laboratory Forensic Anthropology 
Program to examine submitted photographs. 


Administrative: Reference emails sent to | | 

which contained digital photographs of questioned bones recovered 
from the Coventry Landfil l., Newport. Veop ont; reference telephone 
conversations between^ SA | 


I of Albany Division and 


Details: At the request of Anchorage Division, Albany Division 
has been conducting a consent search of the Coventry Landfill 
located in Newport, Vermont since May 7, 2012. The search is 
ongoing as of the date of this communication. The purpose of the 
search is to locate the remains of Bill and Lorraine Currier who 
went missing from Essex, Vermont in June, 2011. 


This communication is in reference to photographs 
labeled QB1 through QB72 that were previously submitted by email 
to the Forensic Anthropology Program for analysis. 
Anthropological examinations are requested on the submitted 
photographs to include determination of whether the pictured 
material is osseous (bone) or dental (tooth) in origin, and 
whether it is human or non-human in origin. 
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To: Laboratory From: Albany 

Re: 306-AN-15642, 06/19/2012 


LEAD(s) : 

Set Lead 1: (Action) 

LABORATORY 

AT QUANTICO, VA 

Conduct requested examinations on submitted 
photographs. 

♦♦ 


UNCLASSIFIED 




(Rev. 05-01*5008) 






UNCLASSIFIED 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE 

To: Anchorage 


Date: 06/20/2012 

Attn: C-2 /Violent Crime Sq uad 

SOS | T 


From: St. Louis 

Contact: IOA I I 


Approved By: r _^ 

Drafted By: 

-2.CS 7 

Case ID #: 306-AN-15642 (Pending) 

Title: MILITARY RECORDS REQUEST 

Synopsis-: St. Louis is providing Anchorage with a Certified Copy 

of 6 Official Military Personnel Folders {OMPF’s). 

Reference: 306-AN-15642 Serial 202 

Administrative: St. Louis considers lead 202.1 covered. 

Details: On 06/20/2012, I I Manager, Reference Core 

One, National Archives and Records Administration, Military 
Personnel Re cords, 1 Archi ves Drive, St. Louis, Missouri, 
provided IOA | | with a Certified Copy of 6 OMPF's 

regarding the following individuals: 

ISRAEL KEYES, SSAN: 127-86-4049 _, 


b6 
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Attached for Anchorage are 6 Certified Copies of the 
OMPF’s. The Certified Copies will be sent separately via Federal 
Express to the FBI, 101 East 6th Avenue, Anchorage, AK 99501. 
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To: Anchorage From: St. Louis 

Re: 306-AN-15642, 06/20/2012 


LEAD(s): 

Set Lead 1: (Info) 

ANCHORAGE 

AT ANCHORAGE, AK 
Read and Clear. 

172 1 b l-EC 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE 

To: Anchorage 
From: 

Contest 
Approved By: 


Date: 06/21/2012 


Anchorage 

SWAT Team Lea der 
SA f 


Drafted By: 


Case ID 


*J?06-AN-15642 {Pending) 
252F-AN-10426 (Pending) 


ISRAEL KEYES; 

SAMANTHA TESSLA KOENIG - VICTIM, 

ET AL; 

SERIAL KILLINGS - VIOLENT CRIMINAL THREAT 


ARMED AND DANGEROUS 


Synopsis: Document participation of Special Weapons And Tactics 

(SWAT) Team mem ber(s) in the execution of a security detail and 
~] operation on frozen Matanuska Lake near Palmer, 
Alaska, on 04/02/2012, in captioned case(s). 


Details: On 04/02/2012, the following Special Weapons And 
Tactics (SWAT) Team member(s) part icipated in the execution of a 
security detail and I 1 operation on frozen Matanuska 

.ear Palmer, Alaska, in captioned case(s): Special Agents 


(SAs) 


|_| (non-operator SWAT Medic). Anchorage Division Executive 

Management authorized the limited deployment of SWAT personnel in 
support of this operation, due to the need to- have tactically- 
trained agents establis h and maintain a secure perimeter around 
the crime scene during | ~| 

operations, which garnered extensive public and media attention 
shortly after they were initiated. 


These activities involved the establishment and 
patrolling of a 360 degree secure perimeter around the scene, 
which was near the middle of a large frozen lake approximately 40 
miles from Anchorage. SWAT personnel repeatedly identified and 
thwarted media and/or public efforts to breach the: perimeter of 
the scene, without injury to anyone. These security efforts were 
performed for over 12 hours in arctic conditions, before and 
during the evidence recovery operation. SWAT personnel assisted 
the forensic dive team in cutting through approximately 30-inch 


/75 | 
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UNCLASSIFIED 


To: Anchorage From: Anchorage 
Re: 306-AN-15642, 06/21/2012 


thick ice, clearing multi-hundred pound ice blocks from the dive 
site using snow machines, and then returning these ice blocks to 
the hole, to mitigate the public safety threat after the site was 
vacated. SWAT personnel also assisted in the set-up and 
dismantlement of the evidence collection stations. 

Due to the joint nature of captioned investigation, 
Anchorage FBI SWAT personnel performed the aforementioned duties 
cooperatively with approximately fi ve members of the Ancho rage 
Police Department (APD) SWAT Team. | | 

recovered without injury to any participants or bystanders, and 
without any interference or evidence tampering issues from 
members of the media and/or the public who were present nearby, 
during most of this operation. 


♦♦ 


ARMED AND DANGEROUS 


UNCLASSIFIED 
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UNCLASSIFIED 

FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 06/21/2012 

To: Anchorage 

From: Anchorage 

SWAT Team Le ader _ 

Contact: SA I J 

Approved By: 


*$06-AN-15642 (Pending) 

252F-AN-10426 (Pending) 

ISRAEL KEYES; 

SAMANTHA TESSLA KOENIG - VICTIM, 

ET AL; 

SERIAL KILLINGS - VIOLENT CRIMINAL THREAT 


Drafted By: 
Case ID #: 

Title: 


b6 

b7C 


ARMED AND DANGEROUS 

Synopsis: Document participation of Special Weapons And Tactics 

(SWAT) Team member(s) in the execution of high risk prisoner 
transports from the Anchorage Jail to and from the Anchorage 
Office of the FBI on the following dates: 05/08/2012, 

05/16/2012, 05/24/2012, 05/29/2012, 06/01/2012, 06/07/2012, in 
captioned case(s). 

Details: On 05/08/2012, 05/16/2012, 05/24/2012, 05/29/2012, 
06/01/2012 and/or 06/07/2012, the following Special Weapons And 
Tactics (SWAT) Team member(s) participated in the execution of 
high risk prisoner transports from the Anchorage Jail to and from 

the Anchorag e Office of the FBI, in captioned case(s): _ Special 

Agents (SAs) j_ 

I Anchorage Division Executive Management 
authorized the limited deployment of SWAT personnel (typically in 
groups of 3-5) in support of these operations, due to the need to 
have tactically-trained agents conduct high risk prisoner 
transports of serial murder subject Israel Keyes. 

These activities' involved unannounced multi-vehicle 
movements between secure facilities, to mitigate the danger the 
subject posed to the public and investigating personnel, as well 
as, to minimize the potential for the successful execution of the 
death threat(s) that were made against the subject, following his 
identification and apprehension. The value of these SWAT 
transport operations was highlighted by the subject's failed 
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To: Anchorage From: Anchorage 
Re: 306-AN-15642, 06/21/2012 


attempt to escape from federal court in the middle of a crowded 
status hearing in captioned matter. Multiple members of the 
Anchorage SWAT Team assisted the U.S. Marshals Service (USMS) in 
preventing the subject’s escape. 

SWAT personnel conducted many of these operations after 
this crime had garnered extensive public and media attention, and 
the subject was aware of the FBI presence, location and/or 
activities. SWAT personnel performed all of these activities 
without injury to anyone (except for minor injuries to the 
subject during the prevention of his escape attempt), and 
provided a measured force protection presence, in support of FBI 
and other agency (i.e. U.S. Attorney’s Office) personnel. Due to 
the joint nature of captioned investigation. Anchorage FBI SWAT 
personnel performed the aforementioned duties cooperatively with 
a senior member of the Anchorage Police Department (APD) SWAT 
Team, who is also one of the co-case agents on captioned matter. 


ARMED AND DANGEROUS 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE 

To: Dallas 


Date: 06/21/2012 

At tn : S S R a[ I 

TFO I I 

Fort Worth RA _ 

Attn: SSRA | 

Tvler RA 

sa I- I 

Lufkin RA 


b6 

b7C 


From: Anchorage 

Squad C-2 

Contact: TFO| 


Approved By: 

Drafted By: 

Case ID #: **306-AN-15642 

Title: ISRAEL KEYES; 

SAMANTHA TESSLA KOENIG - VICTIM; 

ET AL; 

SERIAL KILLINGS - VIOLENT CRIMINAL THREAT 

Synopsis: To clarify recent request for assistance from the 

Lufkin Resident Agency (RA) in the follow-up investigation of 
missing person(s) in or near Rusk, Texas, and an arson in Aledo, 
Texas, as outlined in referenced communication. 

Reference: 306-AN-15642 Serial 209. 

Administrativ e: Referen ce telephone call between Task Force 

Officer (TFO^ I I Anchorage Division, Special Agent ( SA) 

I I Lufkin RA, and Texas Ranger \ I on 

06/15/2012. Also reference follow-up telephone call between SA 
| | Anchorage Divisi on, and Supervisory Senior Resident 

Agent (SSRA) | | Fort Worth RA, on 06/21/2012. 

Details: For background, as outlined in referenced serial, on 

02/01/2012, Samantha Koenig was kidnaped from her place of 
employment by Israel Keyes. Keyes confessed to the kidnaping and 
murder of Koenig and has since been charged federally with 
kidnaping which resulted in the death of Koenig. Koenig's 
remains were recovered in Matanuska Lake, Ak. 
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To: Dallas From: Anchorage 

Re: 306-AN-15642, 06/21/2012 


On 03/13/2012, Israel Keyes was arrested in Lufkin,Tx 
after using an ATM card associated with Samantha Koenig. Since 
being transported back to Anchorage Keyes has been cooperating 
with law enforcement, providing additional information about 
other crimes including kidnaping and murder. Keyes confessed to 
the kidnap and murder of William and Lorraine Currier in Essex, 

VT on 06/08/2011. Currently the FBI and Vermont authorities are 
conducting a search of a landfill in Coventry, VT where the 
Currier bodies are believed to be. 

Israel Keyes confessed to a residential arson in Aledo, 
Texas (believed by law enforcement to be in the 100 block of 
Terrace Court) and a bank robbery in Azle, Texas (previously 
identified and investigated in 91A-DL-111234). Both of these 
incidents occurred on 02/16/2012. Keyes has told law enforcement 
that he is responsible for other victims in several states. Law 
enforcement believes it is possible that Keyes may be responsible 
for additional crimes in Texas, potentially a missing person. 

Law enforcement has followed Keyes' travel in Texas through his 
cell phone records, as well as, his credit card purchases. There 
are at least three reported missing persons in Texas dur ing the 
time frame K eves w.as visiting. Law enforcement believes | | 

I I who was reported missing in or near Mount 

Enterprise/Rusk County, Texas, best fits Keyes' modus operandi. 

On 06/15/2012, referenced serial set a lead to the 
Lufkin RA to conduct logical follow-up investigation regarding 
the aforementioned missing person in Rusk, Texas and the arson in 
Aled o, Texas. On 06/21/ 2012, d uring referenced telephone call, 
SSRA | ladvised SA | |that Aledo, Texas was in Fort 

Worth RA territory, rather than Lufkin RA territory, and 
requested that a lead be set t o the F ort Worth RA to follow-up on 
the arson in Aledo, Texas. SA | ~~| apologized for this 
inadvertent oversight, and drafted this communication to re¬ 
distribute the lead requests recently sent to Dallas and 
memorialize the aforementioned information. 
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To: Dallas From: Anchorage 

Re: 306-AN-15642, 06/21/2012 


LEAD (s) : 

Set Lead 1: (Action) 

DALLAS 

AT LUFKIN, TEXAS 

To c onduct logical inve stigation regarding the missing 
person case of | I of Mount Enterprise/Rusk County, b6 

Texas, and any similar matters within the Lufkin RA territory. b7( 


Set Lead 2: (Action) 

DALLAS 

AT FORT WORTH. TEXAS 

To conduct logical investigation regarding a 
residential arson committed on 02/16/2012, in Aledo, Texas 
(believed by law enforcement to be in the 100 block of Terrace 
Court}, and any similar matters within the Fort Worth RA 
territory. 


♦♦ 
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FD-302 (Rev, 10-6-95) 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 06/22/2012 _ 

_ Per a r equ est from the cas e agent, Special Agent (SA) 

I I SA | I took some "entry” photographs 

of a 1992 Bavliner series P0GPR15, bearing Wash ington State license 
WN7470GB , registered to ISRAEL KEYES, in the Federal Bureau of ‘ 

Investigation Evidence Response Team off-site facility. The_ 

collection of this boat was discuss ed in a prior report. SA | | 

did not touch the boat. SA | |sent a copy of the photographs 

to SA | ~1 


SA | | prepared a photographic log, which was enclosed 

in a FD-340 envelope with an original copy of the photographs’ on a 
CD. 


Investigation on 06/15/2012 at Seattle, WA 
File #* ^30 6 -AN-15642 / 308A-SE-85000-302 
by SA | | _ 


Date dictated _ 


This document contains neither recommendations nor conclusions of the FBI. 
it and its contents are not to be distributed outside your agency. 


It is the property of the FBI and is loaned to your agency; 
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FBI Laboratory 


2501 Investigation Parkway 
Quantico, Virginia 22135 


To: Anchorage Date: July 10,2012 

Sq uad C-2 _ 

SA l I Case ID No.: 306-AN-15642 '"XTy 

Lab No.: 120709001 PF 

Reference: Communication dated July 6, 2012 
Your No.: 

Title: ISRAEL KEYES; 

SAMANTHA TESSLA KOENIG - VICTIM; 

ETAL; 

SERIAL KILLINGS - VIOLENT CRIMINAL THREAT 


Date specimens received: July 9,2012 

The FBI Laboratory has received your request for examination. The accompanying 
items of evidence have been inventoried. The provided listing and description of the submitted 
items may be subject to change when the examination phase begins. If changes are made, they 
will be reflected in the Report of Examination issued by the examiner making the change. 

Specimens: ■ 

Q8 Bone (1B198, E4824615) 


Each examiner assigned to your request will issue a separate Report of Examination 
that will address the results of his/her expertise. For technical questi ons, contact the following 
unit(s) assigned to your case: Trace Evidence Unit - I I 

If there is a change in the status of your investigation that would have an affect on the 
prioritization of your request, such as court deadlines, dismissal of charges, or gui lty pleas ; or if 
you have questions regarding the status of your case, contact Request Coordinate d | 
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2501 Investigation Parkway 
Quantico, Virginia 22135 


REPORT OF EXAMINATION 


To: Anchorage Date: My 11,2012 

Squad C-2 

SA | ] Case ID No.: 306-AN-l 5642 

Lab No.: 120709001 PFUO • 


Reference: Communication dated My 6,2012 
Your No.: 


Title: ISRAEL KEYES; 

SAMANTHA TESSLA KOENIG - VICTIM; 

ETAL; 

SERIAL KILLINGS - VIOLENT CRIMINAL THREAT 


Date specimens received: July 9, 2012 

The following specimen was received in the Trace Evidence Unit (Anthropology): 


Q8 Bone (1B198, E4824615) 


The results of the anthropological examinations are contained in this report 


1 - Rutland RA 
SA 
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Methods: 


The determination of whether skeletal remains are human or non-human in origin is 
typically based on examination of gross bone morphology, looking for features or .landmarks that 
are consistent with human or non-human species. In some cases, additional techniques such as 
quantitative assessment (measurement), microscopic examination, or comparison to published 
literature or exemplars may be employed. 

In this case, the item was examined visually. 


Results of Examinations: 

Item QS is a bone fragment (cranial) of non-human origin. No further anthropological 
examinations were conducted. 


Limitations 

The conclusions that can be reached regarding human or non-human origin are 
dependent on the condition and completeness of the skeletal material. Results based on 
fragmentary or poorly preserved material may be inconclusive. 
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Remarks: 


This report concludes the anthropological examinations conducted by the FBI 
Laboratory. The item will be returned under separate cover at the completion of the laboratory 
examinations. The supporting records for the opinions and interpretations expressed in this report 
are retained in the FBI files. 

For questions about the content of this report, please co ntact Forensic 
Examiner/Anthropologist l I For questions about the status 

of your sub mission, including any remaining fo rensic examinations, please contact Request 
Coordinator ! 1 


Trace Evidence Unit (Anthropology) 


This report contains the opinions/interpretations of the examiner(s) who issued the report. 
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FBI Laboratory 


2501 Investigation Parkway 
Quantico, Virginia 22135 


To: Anchorage Date: July 13,2012 

Sq uad C-2 _ 

SA | | Case ID No.: 306-AN-15642" W 7 b6 

b7C 

Lab No.: 120712003 PF 


Reference: Communication dated July 11,2012^ 

Your No.: 

Title: ISRAEL KEYES; 

SAMANTHA TESSLA KOENIG - VICTIM; 

ETAL; 

SERIAL KILLINGS - VIOLENT CRIMINAL THREAT 


Date specimens received: July 12, 2012 

The FBI Laboratory has received your request for examination. The accompanying 
items of evidence have been inventoried. The provided listing and description of the submitted 
items may be subject to change when the examination phase begins. If changes are made, they 
will be reflected in the Report of Examination issued by the examiner making the change. 

Specimens: 

Q9 Bone (1B199, E4824644) 


Each examiner assigned to your request will issue a separate Report of Examination 
that will address the results of his/her expertise. For technical question s, contact the following 
unit(s) assigned to your case: Trace Evidence Unit - | | 

If there is a change in the status of your investigation that would have an affect on the 
prioritization of your request, such as court deadlines, dismissal of charges, or gui lty plea s; or if 
you have questions regardin g the status of your case, contact Request Coordinator ! I 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 06/26/2012 


b6 

b7C 


To: Anchorage 



From: Anchorage 

Squad C-2_ 
Contact: |_ 


Approved By: 
Drafted By: 


Case ID #: 306-AN-15642 (Pending)— 1 

Title: KEYES, ISRAEL 

KOENIG, SAMANTHA, TESSLA ET AL 


Synopsis: To report results of query made by Violent Criminal 
Apprehension Program (ViCAP) to Enfield Police Department 


Detai ls: On June 18, 2012, St aff Operations Specialist[ 

tasked ViCAP Crime Analyst | J to request more 


information from the Enfield Police Department on missing person 

I 


| 1 went missing in Enfield,Connecticut on 

04/06/2009, last seen by her family on 04/05/2009. Keyes arrived 
in New Hampshire on 04/07/2009, however, ViCAP asked Enfield 
Police Department to verify her dates of disappearance, as well 
as if foul play is suspected. 


Crime Analyst | 1 spoke with Detective | ~| of 

Enfield Poli ce Departme nt who reported that foul play is not 
suspected in | | disappearance and the dates listed in 

National Missing and Unidentified Persons Syst em (NAMUS) are _ 

correct. The NAMUS rep ort also indicates that | 1 

I I Due to this information, 1 M s not 

being considered as a victim of Keyes at this time. 


♦♦ 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE 

To: Anchorage 


Anchorage 
Squad C-2 

Contact: Q 


Date: 06/26/2012 


SSA| 

SA 

SA. 

TFOl 


Approved By: 

Drafted By: 

Case ID #: 306-AN-15642 (Pending) 

Title: KEYES, ISRAEL 

KOENIG, SAMANTHA, TESSLA ET AL 

Synopsis: To report results from requested Violent Criminal 
Apprehension Program (ViCAP) Assistance to query missing persons 
from April 7, 2009 - April 14, 2,009 in eastern Canada 

Reference: 306-AN-15642 Serial 210 

tasked ViCAP 
r. 

missing p ersons during April 7 - 14, 2009. Crime 


Details: Sta ff Operations S pecialist [__ 

Crime Analyst | | to query his - Canada sources for. 

inform ation on -- J —~— *— J ■* n * A ' 


.Analyst I 


L 


1 contacted I 


]who then 


conducted a search of all missing persons in which foul play is 
suspected from April 1 - October 31 during 2009. The search 
failed to provide any positive leads. 
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FEDERAL BUREAU OF INVESTIGATION 

Precedence: ROUTINE Date: 06/26/2012 

b6 
b7C 


To: Anchorage Attn: SSA' 

SA 

SA 

TFO 


From: Anchorage 

Squad C-2 
Contact: [ 


Approved By: 

Drafted By: _ 

Case ID #: 306-AN-15642 (Pending) — 

Title: KEYES, ISRAEL 

KOENIG, SAMANTHA, TESSLA ET AL 

Synopsis: To report results of National Crime Information Center 

(NCIC) off-line search on Israel KEYES and rental car vehicles 
associated with KEYES, provided by Violent Criminal Apprehension 
Program (ViCAP) Assistance 

Enclosure(s): ViCap email and NCIC off-line results 

Detai ls: On June 13, 2012, Staff Operations Specialist I I 

I I received results of an NCIC off-line search on Israel KEYES 
and his associa ted rental car vehicles from ViCAP Crime Analyst 


Crime Analyst | | made note of a query that occurred 

on 01/28/2008 of<KEYES' rental car vehicle, license plate number 
95B9427. According to KEYES’ travel records, he flew into 
Mobile, Alabama on 01/28/2008. Since his license plate number 
was only run and not his name, it was determined that no physical 
contact was actually made with KEYES and it is not necessary to 
contact the Mobile County Sheriff's Office at this time. 

The queries conducted of KEYES will assist in giving 
additional dates and locations of his whereabouts and will be 
added to his timeline. 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 06/26/2012 


To: Anchorage Attn: SS2 

SA 

SA 

TFC 


From: Anchorage 

Squad C-2 

Contact: [ 


Approved By- 
Drafted By: 
Case ID #: 


306-AN-15642 (Pending) -£p3 L / 


Title: KEYES) ISRAEL 

KOENIG, SAMANTHA, TESSLA ET AL 


Synopsis: To report results of query of Israel KEYES' name with 

the Central Violations Bureau 


Enclosure.(s) : Email from Central Violations Bureau 


Detai ls: On June 25, 2012, Staff Operations SpecialistQ 


I | received results of a Central Violations Bureau query of 
Israel KEYES' name. The results are attached. 
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FBI Laboratory 


REPORT OF EXAMINATION 


2501 Investigation Parkway 
Quantico, Virginia 22135 


To: 


Anchorage 
Squad C-2 

SA f^ 


Date: July 16,2012 

Case ID No.: 306-AN-l 5642 'Ui& 

Lab No.: 120712003 PFUO 


b6 

b7C 


Reference: Communication dated July 11, 2012 
Your No.: 

Title: ISRAEL KEYES; 

SAMANTHA TESSLA KOENIG - VICTIM; 

ETAL; 

SERIAL KILLINGS - VIOLENT CRIMINAL THREAT 


Date specimens received: July 12,2012 

The following specimen was received in the Trace Evidence Unit (Anthropology): 
Q9 Bone (1B199, E4824644) 


The results of the anthropological examinations are contained in this report. 


1-Albany 
Rutland RA 


saQ 


Page 1 of3 

1 fifty 


UNCLASSIFIED 


3Q6-AH-)5M>QVg40 



UNCLASSIFIED 


Methods: 


The determination of whether skeletal remains are human or non-human in origin is 
typically based on examination of gross bone morphology, looking for features or landmarks that 
are consistent with human or non-human species. In some cases, additional techniques such as 
quantitative assessment (measurement), microscopic examination, or comparison to published 
literature or exemplars may be employed. 

In this case, the item was examined visually. 


Results of Examinations: 

Item Q9 is a bone (rib) of non-human origin. No further anthropological 
examinations were conducted. 


Limitations 

The conclusions that can be reached regarding human or non-human origin are 
dependent on the condition and completeness of the skeletal material. Results based on 
fragmentary or poorly preserved material may be inconclusive. 
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Remarks: 


This report concludes the anthropological examinations conducted by the FBI 
Laboratory. The item will be returned under separate cover at the completion of the laboratory 
examinations. The supporting records for the opinions and interpretations expressed in this report 
are retained in the FBI files. 


For questions about the content of this report, please c ontact Forensic 
Examiner/Anthropologist l I For questions about the status 

of your sub mission, including any remaining fore nsic examinations, please contact Request 
Coordinator ! I 


trace tviaence unit (Antnropoiogy; 
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FBI Laboratory 


2501 Investigation Parkway 
Quantico, Virginia 22135 


To: 


Anchorage 
Sq uad C-2 
SA j 


Date: July 19,2012 

n JJ 

Case ID No.: 306-AN-15642 
Lab No.: 120717013 PF 


b6 

b7C 


Reference: Communication dated July 16, 2012 
Your No.: 

Title: ISRAEL KEYES; 

SAMANTHA TESSLA KOENIG - VICTIM; 

ETAL; 

SERIAL KILLINGS - VIOLENT CRIMINAL THREAT 


Date specimens received: July 17,2012 

The FBI Laboratory has received your request for examination. The accompanying 
items of evidence have been inventoried. The provided listing and description of the submitted 
items may be subject to change when the examination phase begins. If changes are made, they 
will be reflected in the Report of Examination issued by the examiner making the change. 

Specimens: 

Q10 Bone (1B203, E4254810) 


Each examiner assigned to your request will issue a separate Report of Examination 
that will address the results of his/her expertise. For technical questio ns, contact the following 
unit(s) assigned to your case: Trace Evidence Unit - I I 

If there is a change in the status of your investigation that would have an affect on the 
prioritization of your request, such as court deadlines, dismissal of charges, or gui lty plea s; or if 
you have questions regarding the status of your case, contact Request Coordinator ! | 
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FBI Laboratory Shipping Invoice 
Federal Bureau of Investigation 
2501 Investigation Parkway 
Quantico, VA 22135 

Date: 07/20/2012 


FBl-Albany 
Attn: ECT 

200 McCarty Avenue 
Albany, NY 12209-2095 


Telephone Number: 


Carrier: 

Classification Lewi: 

0 FedEx : 

□ Unclassified-Not Sensitive 

□ USPS Registered 

0 Unclassified-Sensitive 

| | Other 

□ Confidential 


LJ Secret 


Special Services: 

l~] Saturday Delivery 1~1 Return- Kec^tgt-fOSPS only) f~| Fragile Material* 0 Perishable Material* 


F~1 Hazardous Material* ? (Pacl<sj£6$ fey , . _Date:_) 

h . (Signature) 

•asterisked items must bt; describe d below ■/ 

Description of Contents: 

Q9 


Declared Value $ WA _ 

(Required for International Shipments) 


FBI File#: 

308-AN-15642 

Lab #(s): 

120712003 PF 


iibiiw JiiiMiilia&fflMmi 


Tracking Information: 

Point-of-Contact Information: 

Name: 1 1 Ext.i-1 

Unit: ECU R m: 1267 

Initials of Preparer: 1_1 
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Federal Bureau of Investigation 
Laboratory Division 


LABORATORY WORK SHEET 


To: 


Anchorage 
Squad C-2 


SA[ 


Reference: Communication dated July 11,2012 
Your No.: 


Date: July 13, 2012 
Case ID No.: 306-AN-15642 
Lab No.: 120712003 PF 


Title: ISRAEL KEYES; 

SAMANTHA TESSLA KOENIG - VICTIM; 

ETAL; 

SERIAL KILLINGS - VIOLENT CRIMINAL THREAT 


Date specimens received: July 12, 2012 
Specimens: 

Q9 Bone (IB 199, E4824644); 


1- Albany 
Rutland RA 


SA[ 
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